CVE-2026-41669 Overview
CVE-2026-41669 is a signature verification flaw [CWE-347] in Admidio, an open-source user management solution. The vulnerability affects all versions prior to 5.0.9. The Admidio SAML Identity Provider implementation discards the return value of its validateSignature() method at both call sites: handleSSORequest() line 418 and handleSLORequest() line 613. The method returns error strings on failure rather than throwing exceptions. As a result, the smc_require_auth_signed configuration option is completely ineffective. Unsigned or invalidly-signed SAML AuthnRequest and LogoutRequest messages are processed identically to properly signed ones. Admidio version 5.0.9 patches the issue.
Critical Impact
Attackers can forge SAML AuthnRequests and LogoutRequests to impersonate users or terminate sessions, bypassing the SAML signature requirement entirely.
Affected Products
- Admidio versions prior to 5.0.9
- Admidio SAML Identity Provider component
- Deployments relying on the smc_require_auth_signed configuration option
Discovery Timeline
- 2026-05-07 - CVE-2026-41669 published to NVD
- 2026-05-07 - Last updated in NVD database
- Patch released - Admidio v5.0.9 contains the fix per the GitHub Release v5.0.9
Technical Details for CVE-2026-41669
Vulnerability Analysis
The flaw stems from a developer assumption mismatch in the Admidio SAML IdP code. Comments at lines 416 and 611 indicate the original author expected validateSignature() to throw an exception on validation failure. The method instead returns an error string when signature verification fails. Both call sites discard this return value and continue processing the SAML message. The smc_require_auth_signed configuration option, which administrators rely on to mandate signed SAML requests, has no enforcement path. An attacker who can reach the IdP endpoint can submit crafted AuthnRequest or LogoutRequest messages without valid XML-DSig signatures and have them accepted as authentic.
Root Cause
The root cause is improper verification of cryptographic signature [CWE-347]. The control flow assumes exception-based error propagation, while the implementation uses return-value-based error reporting. Because neither caller inspects the returned string, all signature outcomes converge to the success path. The configuration toggle that should enforce signature verification becomes a no-op.
Attack Vector
Exploitation requires network access to the Admidio SAML endpoints. The attacker crafts a SAML AuthnRequest containing arbitrary issuer, subject, or relay-state values, omits or invalidates the XML signature, and submits it to handleSSORequest(). The IdP processes the request as if signed, enabling Service Provider impersonation, response redirection, or session manipulation. The same primitive applied to handleSLORequest() lets attackers force logouts of arbitrary sessions, producing a targeted session-termination capability against authenticated users.
No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-25cw-98hg-g3cg for further technical context.
Detection Methods for CVE-2026-41669
Indicators of Compromise
- SAML AuthnRequest or LogoutRequest messages reaching Admidio IdP endpoints without a <ds:Signature> element while smc_require_auth_signed is enabled.
- Authentication or logout events in Admidio logs that lack a corresponding signed-request audit entry.
- Unexpected Service Provider issuers or relay-state values in SAML traffic destined for the Admidio IdP.
Detection Strategies
- Inspect SAML traffic at the web application firewall or reverse proxy and alert on requests missing the Signature element when sent to Admidio IdP routes.
- Compare authenticated session origins against expected Service Provider entity IDs and flag anomalies.
- Monitor application logs for repeated AuthnRequest submissions from a single source targeting multiple user contexts.
Monitoring Recommendations
- Capture full HTTP request bodies for SAML endpoints to allow retroactive signature analysis.
- Track the Admidio version string across deployments and alert when instances below 5.0.9 remain in production.
- Correlate Admidio logout events with user-reported session terminations to identify forced-logout abuse.
How to Mitigate CVE-2026-41669
Immediate Actions Required
- Upgrade all Admidio instances to version 5.0.9 or later without delay.
- Audit SAML IdP access logs for unsigned or malformed requests since the IdP feature was enabled.
- Rotate any SAML signing keys that may have been used to validate trust relationships affected by the bypass.
Patch Information
Admidio version 5.0.9 fixes the issue by enforcing the return value of validateSignature() at both call sites. Download details are available in the GitHub Release v5.0.9. Administrators should validate post-upgrade that signed-request enforcement now rejects unsigned AuthnRequest and LogoutRequest messages.
Workarounds
- Restrict network access to the Admidio SAML IdP endpoints to known Service Provider source addresses until the patch is applied.
- Disable the SAML IdP module on instances that cannot be immediately upgraded.
- Place the application behind a reverse proxy that rejects SAML messages lacking a <ds:Signature> element.
# Verify Admidio version after upgrade
grep -R "ADMIDIO_VERSION" /path/to/admidio/adm_program/system/constants.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
