CVE-2026-47234 in Admidio
Summary
by MITRE • 08/12/2026
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Admidio versions prior to 5.0.10 represents a critical security flaw that exposes session credentials through improper logging practices. This issue specifically affects deployments where debug logging is enabled, creating an attack surface that allows unauthorized access to active user sessions and persistent auto-login tokens. The technical implementation flaw occurs within the Session class methods that handle cookie management and session initialization, where sensitive information is inadvertently written to log files without proper sanitization or obfuscation.
The vulnerability manifests through two distinct logging operations that capture sensitive session data in plain text format. When `Session::setCookie()` is executed with debug logging enabled, it logs the complete cookie values including both the active session identifier and the persistent auto-login cookie that contains long-term authentication tokens. Additionally, `Session::start()` logs the current session ID, which serves as a bearer token for accessing protected resources. These log entries contain credentials in their entirety without any form of redaction or encryption, making them immediately exploitable by anyone with access to the logging infrastructure.
The operational impact of this vulnerability extends beyond simple credential theft to encompass full account compromise and potential system infiltration. Attackers who gain access to the log files can extract active session cookies and auto-login tokens that grant immediate access to user accounts without requiring additional authentication factors. This creates a persistent threat where attackers can maintain access even after session expiration, as the auto-login cookies remain valid for extended periods. The vulnerability affects both authenticated users and administrators, potentially enabling privilege escalation attacks when combined with other exploitation techniques.
The fix implemented in version 5.0.10 addresses this issue by ensuring that sensitive session data is properly sanitized before logging operations occur. This remediation aligns with security best practices outlined in the CWE (Common Weakness Enumeration) catalog under CWE-532, which specifically addresses information exposure through log files. The solution follows established patterns from the MITRE ATT&CK framework's credential access tactics, particularly those related to credential dumping and privilege escalation. Organizations should implement comprehensive logging policies that prevent sensitive data exposure while maintaining necessary diagnostic capabilities for system maintenance and troubleshooting.
Security practitioners should conduct immediate assessments of all Admidio deployments to verify proper configuration of debug logging settings and ensure that no sensitive session information is being written to log files. The vulnerability demonstrates the importance of secure coding practices and proper input validation in web applications, particularly when handling authentication tokens and session management components. Regular security audits should include verification of logging configurations to prevent similar issues in other software components that may inadvertently expose credential data through improper logging operations.