CVE-2026-41670 Details

A vulnerability exists in Admidio's SSO module SAML IdP implementation, prior to version 5.0.9. The issue arises because the IdP uses the AssertionConsumerServiceURL from incoming SAML AuthnRequest messages as the response destination, without validating it against the registered ACS URL in the database for the corresponding service provider client. This flaw allows an attacker who knows the Entity ID of a registered SP client to craft a SAML AuthnRequest with a malicious AssertionConsumerServiceURL. As a result, the IdP sends a signed SAML response, containing user identity attributes such as login name, email, roles, and profile fields, to an attacker-controlled URL.

Users are advised to update to Admidio version 5.0.9 or later, where this vulnerability has been patched. For those using version 5.0.8 or earlier, it is recommended to manually validate the AssertionConsumerServiceURL against the registered ACS URL for the corresponding Service Provider client before processing SAML responses.