Description

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an administrator session can therefore trigger private key export without a valid form token. Version 5.0.10 contains a fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T14:17:54.360Z",
  "pubdate": "2026-08-12T14:17:54.360Z",
  "executiveSummary": "Admidio prior to version 5.0.10 is affected by a missing Cross-Site Request Forgery (CSRF) vulnerability in the sensitive private key export functionality.\nThe vulnerability allows an unauthenticated external entity to leverage an active administrator session to silently trigger the export of a PKCS#12 bundle containing the configured private key and certificate.\nThe primary impact involves the unauthorized disclosure of cryptographic material, specifically private keys and certificates, which severely compromises the confidentiality and integrity of the application's secure communications and single sign-on (SSO) configuration.\nThe affected product is Admidio, specifically open-source user management solutions running versions prior to 5.0.10.\nRisk implications are high because the extraction of private keys enables potential man-in-the-middle attacks, impersonation, and decryption of sensitive traffic associated with the affected SSO deployment.\nAttacker capabilities require the ability to interact with a victim administrator via a crafted malicious web page or link.\nExploitation requirements dictate that an authenticated administrator must execute a forged cross-site POST request while maintaining an active session within the target application.",
  "technicalDetails": "The vulnerability resides within the file modules/sso/keys.php handling the sensitive mode=export action.\nThe root cause of the flaw is an omitted or commented-out Cross-Site Request Forgery (CSRF) validation check within the request handling logic, bypassing the verification of form security tokens.\nAffected versions include all Admidio installations prior to version 5.0.10.\nThe vulnerable component is the SSO key management module responsible for handling cryptographic assets.\nPrivilege requirements involve an authenticated administrator session on the client side, although the forged request itself originates from an external context via an untrusted web site.\nNetwork exposure is standard web-based exposure, requiring the attacker to deliver a malicious payload over HTTP or HTTPS to the administrator's browser.\nThe attack flow begins when an administrator with an active session visits a malicious website controlled by an attacker.\nThe malicious website automatically initiates a forged cross-site POST request targeting modules/sso/keys.php with the mode=export parameter.\nBecause the CSRF validation line is commented out in the source code, the application fails to validate the absence or invalidity of the anti-CSRF token.\nThe server processes the request within the context of the authenticated administrator session, executing the export action.\nThe payload behavior results in the generation and delivery of a PKCS#12 bundle containing the sensitive private key and certificate directly to the request initiator or capturing mechanism.\nThe post-exploitation impact includes the permanent compromise of the exported cryptographic keys, allowing attackers to decrypt intercepted traffic, forge tokens, or impersonate the SSO entity in subsequent operations."
}