CVE-2026-69092 in Admidio
Summary
by MITRE • 08/03/2026
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within the Admidio authentication system prior to version 5.0.11, specifically affecting the Single Sign-On and Security Assertion Markup Language endpoint. The flaw manifests as a reflected cross-site scripting vulnerability that occurs when the system echoes unencoded exception messages back to HTTP responses without proper sanitization or encoding mechanisms. The vulnerability stems from insufficient input validation and output encoding practices within the SAML processing logic, allowing malicious actors to inject JavaScript code through carefully crafted SAML Issuer elements or parameters passed to the LightSaml library.
The technical exploitation of this vulnerability occurs when unauthenticated attackers submit malicious payloads through SAML Issuer parameters or other LightSaml library inputs that are then reflected back in the HTTP response without proper HTML encoding. This creates a scenario where JavaScript code becomes executable within the context of users' browsers who interact with the vulnerable endpoint. The attack vector leverages the fact that the application does not properly encode exception messages before returning them to clients, creating an opening for malicious script injection. According to CWE-79, this represents a classic reflected cross-site scripting vulnerability where user-controllable data flows through the application and back to users without adequate sanitization.
The operational impact of this vulnerability is significant as it enables attackers to execute arbitrary JavaScript code within victims' browsers, potentially leading to session hijacking, credential theft, and unauthorized access to protected administrative functions. Attackers can craft malicious SAML requests that contain JavaScript payloads which are then reflected back through exception messages, allowing them to establish persistent browser-based attacks against authenticated users. This vulnerability directly aligns with ATT&CK technique T1566.002 which describes the use of malicious SAML responses as a method for initial access and privilege escalation. The ability to inject code through SAML parameters makes this particularly dangerous in enterprise environments where Admidio is used for user management and authentication.
Mitigation strategies should focus on implementing proper input validation and output encoding mechanisms throughout the SAML processing pipeline. Organizations should ensure that all exception messages and user-supplied inputs are properly encoded before being returned to HTTP responses, with particular attention to the LightSaml library integration. The recommended approach includes implementing strict parameter validation for SAML Issuer elements, applying HTML encoding to all dynamic content in responses, and upgrading to Admidio version 5.0.11 or later which contains patches addressing this specific vulnerability. Additionally, network-level protections such as web application firewalls should be configured to detect and block suspicious SAML parameter patterns, while security monitoring should be enhanced to identify potential exploitation attempts through anomalous HTTP response patterns.