CVE-2026-69092: Admidio SAML Endpoint XSS Vulnerability

CVE-2026-69092 Overview

CVE-2026-69092 is a reflected cross-site scripting (XSS) vulnerability affecting Admidio versions before 5.0.11. The flaw resides in the Single Sign-On (SSO) and Security Assertion Markup Language (SAML) endpoint, which echoes unencoded exception messages back into the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters. When a victim follows a crafted link, the payload executes in the browser under the Admidio origin. This enables session hijacking, credential theft, and unauthorized actions on behalf of authenticated users. The issue is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser and hijack authenticated Admidio sessions through a crafted SAML request.

Affected Products

Admidio versions prior to 5.0.11
Admidio SSO/SAML endpoint using the LightSaml library
Admidio deployments exposing the SAML integration to untrusted networks

Discovery Timeline

2026-08-03 - CVE-2026-69092 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69092

Vulnerability Analysis

Admidio is an open-source membership and user management application written in PHP. The SSO/SAML endpoint processes inbound SAML authentication requests using the LightSaml library. When the library raises an exception, for example due to a malformed Issuer element or invalid parameter, Admidio writes the exception message directly into the HTTP response body without HTML encoding.

An attacker constructs a SAML request that triggers an exception carrying attacker-controlled data inside the error message. The unsanitized string reaches the browser inside an HTML context and executes as JavaScript. Because the endpoint accepts unauthenticated requests, exploitation only requires enticing a target to click a crafted URL.

Execution occurs within the Admidio session context. This allows theft of session cookies not marked HttpOnly, extraction of Cross-Site Request Forgery (CSRF) tokens, and issuance of authenticated API calls against the victim's account.

Root Cause

The root cause is missing output encoding of exception messages returned by the LightSaml library. User-controlled fields inside a SAML AuthnRequest, including the Issuer element, propagate into exception text that the application renders as HTML rather than as plain text.

Attack Vector

Exploitation is remote and network-based. The attacker crafts a malicious link or auto-submitting form that delivers a poisoned SAML request to the Admidio SSO endpoint. When a logged-in user visits the link, the reflected payload executes in their browser. See the Admidio GitHub Security Advisory GHSA-7jxv-38f3-6xgf and the VulnCheck Advisory on Admidio XSS for further technical detail.

// No verified proof-of-concept code is published for this CVE.
// Refer to the linked advisories for reproduction details.

Detection Methods for CVE-2026-69092

Indicators of Compromise

HTTP requests to Admidio SSO/SAML endpoints containing <script>, onerror=, javascript:, or encoded variants inside SAMLRequest parameters or Issuer fields
Response bodies from the SAML endpoint that contain reflected script tags or event handlers within exception text
Referrer patterns showing users arriving at Admidio SSO URLs from external, unrelated domains

Detection Strategies

Deploy web application firewall (WAF) rules that inspect base64-decoded SAMLRequest payloads for HTML and JavaScript syntax
Alert on Admidio HTTP responses that return HTTP 400 or 500 status codes and contain reflected user input
Correlate authentication events with anomalous SAML request failures originating from the same client IP addresses

Monitoring Recommendations

Enable verbose logging on the Admidio SSO endpoint and forward logs to a central analytics platform for retention and search
Monitor for session token reuse from unexpected IP addresses or user agents following SAML endpoint activity
Track browser-side Content Security Policy (CSP) violation reports if CSP is deployed against the Admidio origin

How to Mitigate CVE-2026-69092

Immediate Actions Required

Upgrade Admidio to version 5.0.11 or later on all instances exposing the SSO/SAML endpoint
Audit web server logs for prior requests to the SAML endpoint containing script syntax or unusual Issuer values
Invalidate active sessions and require re-authentication after patching to eliminate hijacked sessions

Patch Information

The maintainers fixed the issue in Admidio 5.0.11 by properly encoding exception output on the SSO/SAML endpoint. Review the GitHub Security Advisory GHSA-7jxv-38f3-6xgf for the official fix commit and release notes.

Workarounds

Disable the SSO/SAML endpoint in Admidio configuration until the upgrade is applied, if SAML is not required
Restrict access to the SAML endpoint using network access control lists limited to trusted identity provider IP ranges
Deploy a WAF rule blocking requests to the SSO endpoint that contain HTML tags or JavaScript keywords inside decoded SAML parameters

bash

# Example: restrict access to the Admidio SSO endpoint at the reverse proxy (nginx)
location /adm_program/modules/sso/ {
    allow 10.20.30.0/24;   # trusted IdP subnet
    deny  all;
    proxy_pass http://admidio_backend;
}