CVE-2026-47229: Admidio SSO Client CSRF Vulnerability

CVE-2026-47229 Overview

Admidio is an open-source user management solution used to organize members, groups, and single sign-on (SSO) integrations. CVE-2026-47229 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in modules/sso/clients.php affecting versions prior to 5.0.10. The enable branch of the SSO client controller loads a Security Assertion Markup Language (SAML) or OpenID Connect (OIDC) client by UUID and calls $client->enable($enabled) without validating the adm_csrf_token. An attacker can craft a page that causes an authenticated administrator to disable or silently re-enable any configured SSO client through a plain GET request.

Critical Impact
Disabling an SSO client through this CSRF flaw breaks every downstream relying-party application that authenticates through the affected SAML or OIDC integration.

Affected Products

Admidio versions prior to 5.0.10
SAML SSO client configurations managed through Admidio
OIDC SSO client configurations managed through Admidio

Discovery Timeline

2026-08-12 - CVE-2026-47229 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-47229

Vulnerability Analysis

The controller at modules/sso/clients.php handles multiple state-changing actions for SSO client management. Every branch except enable validates the adm_csrf_token parameter before applying changes. The enable case skips this check entirely and proceeds to load the SAML or OIDC client by UUID. The controller then calls $client->enable($enabled) and persists the new state to the database.

Because the vulnerable action accepts parameters over HTTP GET, an attacker only needs an authenticated administrator to visit an attacker-controlled page. A single embedded image or automatic redirect issues the request using the administrator's session cookies. The result is silent modification of authentication infrastructure without any indication to the victim.

Root Cause

The root cause is inconsistent CSRF token enforcement across sibling actions in the same controller. Developers protected write operations selectively rather than at a central request pipeline, leaving the enable branch exposed. Combined with acceptance of GET verbs for state-changing operations, the missing token check reduces exploitation to a passive drive-by request.

Attack Vector

Exploitation requires an authenticated Admidio administrator to load attacker-controlled content in a browser session that holds a valid Admidio cookie. The attacker constructs a URL targeting modules/sso/clients.php with the enable action, the target client UUID, and the desired boolean state. When the administrator's browser issues the request, Admidio processes it as legitimate. Disabling a production SSO client immediately terminates authentication for all downstream relying-party applications; silently re-enabling a decommissioned client can restore stale trust relationships.

See the GitHub Security Advisory GHSA-xg76-5qj2-2hhv for the maintainer's technical write-up.

Detection Methods for CVE-2026-47229

Indicators of Compromise

Web server access log entries containing modules/sso/clients.php with an enable action parameter and a Referer header pointing to an external origin.
Unexpected transitions of SAML or OIDC client enabled state in the Admidio database change history.
Downstream relying-party applications reporting sudden authentication failures tied to a specific Admidio SSO client.

Detection Strategies

Alert on HTTP GET requests to modules/sso/clients.php where the query string contains mode=enable and the Referer header is absent or off-domain.
Correlate administrator session activity with SSO client state changes to identify actions that did not originate from the Admidio administrative UI.
Review audit logs for client->enable operations that lack a preceding CSRF-validated request in the same session.

Monitoring Recommendations

Enable verbose logging for the SSO module and forward events to a centralized log store for retention and search.
Monitor authentication error rates in downstream SAML and OIDC relying parties as a leading indicator of unauthorized client disablement.
Track administrator browser telemetry for visits to untrusted external sites immediately preceding configuration changes.

How to Mitigate CVE-2026-47229

Immediate Actions Required

Upgrade Admidio to version 5.0.10 or later, which enforces adm_csrf_token validation on the enable branch.
Audit current SAML and OIDC client enabled states against the intended configuration and restore any unexpected values.
Instruct administrators to log out of Admidio when not actively managing the platform to shrink the CSRF exposure window.

Patch Information

The Admidio maintainers released version 5.0.10 with a fix that adds the missing CSRF token check to the enable action in modules/sso/clients.php. Deployment details and the patched source are available in the GitHub Security Advisory GHSA-xg76-5qj2-2hhv.

Workarounds

Restrict administrative access to Admidio to a dedicated browser profile that does not visit untrusted sites.
Place Admidio administrative endpoints behind a reverse proxy that enforces SameSite=Strict session cookies and rejects cross-origin Referer headers.
Limit network access to modules/sso/clients.php to trusted administrative IP ranges until the upgrade is complete.

bash

# Example nginx snippet to block cross-origin requests to the SSO client controller
location ~ /modules/sso/clients\.php$ {
    if ($http_referer !~* "^https://admidio\.example\.com/") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}