CVE-2026-109327: Admidio Reflected XSS Vulnerability

CVE-2026-109327 Overview

CVE-2026-109327 is a reflected cross-site scripting (XSS) vulnerability in Admidio, an open-source membership management system. The flaw resides in system/redirect.php and stems from an incomplete fix for [CVE-2021-43810]. Unauthenticated attackers can inject JavaScript through the url GET parameter by crafting a javascript: URL containing a decoy http:// segment that bypasses the existing URL validation. When a victim clicks the malicious redirect link, the injected script executes in the Admidio origin, enabling session theft, account takeover, or further client-side attacks against authenticated users.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the Admidio origin by luring victims to crafted redirect URLs, risking session hijacking and account compromise.

Affected Products

Admidio versions 4.0.12 through 4.3.17
Admidio 5.0.0 through 5.0.14 (fixed in 5.0.15)
Deployments of system/redirect.php exposed to untrusted users

Discovery Timeline

2026-10-12 - CVE-2026-109327 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109327

Vulnerability Analysis

Admidio exposes a server-side redirect handler at system/redirect.php that accepts a target URL through the url GET parameter. The original fix for [CVE-2021-43810] attempted to block dangerous schemes such as javascript: by inspecting the parameter for an http:// or https:// substring. The replacement validation is not strict enough. An attacker can place a decoy http:// substring anywhere in a javascript: URL to satisfy the check while retaining a script payload that the browser still parses as a JavaScript URI.

When a victim follows the crafted link, the server reflects the attacker-controlled value into a redirect flow, and the browser executes the embedded script within the Admidio origin. This gives the attacker access to the session cookie, Document Object Model (DOM) contents, and any Cross-Site Request Forgery (CSRF) tokens visible to the page. The flaw is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is an incomplete allowlist in the redirect validation logic. The code checks for the presence of http:// or https:// as a substring rather than parsing the URL and verifying that the scheme itself is HTTP or HTTPS. Any javascript: URL embedding one of those strings bypasses the control.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker constructs a URL such as a request to system/redirect.php whose url parameter contains a javascript: payload with a decoy http:// substring. The attacker delivers the link through phishing, forum posts, or malicious advertising. When an authenticated Admidio user clicks it, the browser executes the injected script in the application origin.

See the GitHub Security Advisory GHSA-vxfg-x6vc-7w3w and the Vulncheck Advisory for Admidio for additional technical context.

Detection Methods for CVE-2026-109327

Indicators of Compromise

Web server access logs showing requests to system/redirect.php with a url parameter beginning with javascript: or containing URL-encoded javascript%3A.
Requests to system/redirect.php where the url value contains both a scripting scheme and an embedded http:// or https:// substring.
Referer headers that trace Admidio sessions back to external phishing or spam domains distributing the crafted link.

Detection Strategies

Inspect HTTP traffic for GET requests against system/redirect.php and alert when the decoded url parameter does not start with http:// or https://.
Deploy a Web Application Firewall (WAF) rule that blocks the javascript: scheme in any query string parameter named url across the Admidio virtual host.
Hunt for reflected XSS patterns in historical logs using regular expressions matching javascript: followed by decoy HTTP substrings.

Monitoring Recommendations

Enable verbose access logging on the Admidio web tier and forward logs to a central analytics platform for retention and correlation.
Alert on sudden spikes in system/redirect.php traffic, especially from external referrers, which can indicate active phishing campaigns.
Monitor administrator and privileged user sessions for anomalous actions following clicks on redirect URLs.

How to Mitigate CVE-2026-109327

Immediate Actions Required

Upgrade Admidio 5.x deployments to version 5.0.15 or later, which contains the corrected validation logic.
For 4.x branches, plan migration to 5.0.15 or apply the vendor patch addressing the system/redirect.php validation.
Invalidate active administrator sessions and rotate credentials if evidence suggests users clicked crafted redirect links.

Patch Information

The vendor fixed the vulnerability in Admidio 5.0.15. The patch replaces substring-based scheme checks with explicit URL parsing that validates the scheme component against an allowlist of http and https. Refer to the GitHub Security Advisory GHSA-vxfg-x6vc-7w3w for the authoritative patch reference.

Workarounds

Restrict access to system/redirect.php at the web server or reverse proxy layer until the upgrade is applied.
Add a WAF rule that rejects requests where the url parameter does not strictly begin with http:// or https:// after URL decoding.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to reduce the impact of reflected XSS payloads.

bash

# Example nginx rule to block non-HTTP(S) targets in system/redirect.php
location = /system/redirect.php {
    if ($arg_url !~* "^https?%3A%2F%2F|^https?://") {
        return 403;
    }
}