Description

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-12T15:17:33.957Z",
  "pubdate": "2026-08-12T15:17:33.957Z",
  "executiveSummary": "Admidio prior to version 5.0.10 suffers from a sensitive information disclosure vulnerability stemming from insecure debug logging practices. When debug logging is enabled, the application improperly records sensitive authentication material, specifically active session cookies and persistent auto-login cookies, into application logs via the internal session management functions. This flaw impacts all deployments of the Admidio user management solution running vulnerable versions where debug logging is active. The risk implication is severe, as unauthorized entities with access to the log sink can harvest live bearer-style credentials, enabling complete account takeover and unauthorized administrative access without requiring further interaction with the authentication mechanisms. Exploitation requires the attacker to have read access to the system log files where debug information is recorded. Remediation is achieved by updating the software to version 5.0.10 or later, which addresses the logging behavior.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of sensitive state data within the session management subsystem of Admidio. Specifically, the vulnerable component comprises the Session::setCookie() and Session::start() functions. When the application operates with debug logging enabled, Session::setCookie() logs the full and unmasked values of generated cookies, while Session::start() explicitly records the active session identifier. In a standard production or real-world deployment of Admidio, these functions process and emit both the active session cookie and the long-lived persistent auto-login cookie directly into the designated log sink.\nThe exploitation method is passive or active depending on how an unauthorized actor gains access to the logging infrastructure. An attacker with read access to the application logs—whether through misconfigured file permissions, local file inclusion (LFI), log management platform exposure, or insider threat vectors—can inspect the historical or real-time debug output. Because the logged strings contain active session cookies and persistent auto-login tokens, these values function as bearer credentials. The step-by-step attack flow involves: first, ensuring or waiting for debug logging to be active on the target Admidio instance; second, observing or exfiltrating the log files generated by the application; third, extracting the cleartext session IDs and auto-login cookie values from the log entries produced by Session::setCookie() and Session::start(); and fourth, injecting these harvested credentials into an HTTP client request header to impersonate the legitimate user.\nThe affected versions include all releases of Admidio prior to version 5.0.10. The vulnerability requires no specialized privileges or authentication to exploit provided the attacker can read the log sink. The network exposure depends entirely on the accessibility of the log storage mechanism or secondary vulnerabilities exposing log files. The post-exploitation impact allows an unauthorized user to bypass authentication controls entirely, hijacking active sessions or establishing persistent unauthorized access corresponding to the privilege level of the compromised user account."
}