8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41669

CVE-2026-41669: Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed

Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio SAML Identity Provider implementation discards the return value of its validateSignature() method at both call sites (handleSSORequest() line 418 and handleSLORequest() line 613). The method returns error strings on failure rather than throwing exceptions, but the developer believed it would throw (per comments on lines 416 and 611). This means the smc_require_auth_signed configuration option is completely ineffective — unsigned or invalidly-signed SAML AuthnRequests and LogoutRequests are processed identically to properly signed ones. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41669

CVE-2026-41669:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from a logical error in how SAML signature validation results were communicated. The SAMLService.validateSignature function returned an error message as a string upon failure, while the calling functions, SAMLService.handleSSORequest and SAMLService.handleSLORequest, expected an exception to be thrown and did not inspect the return value. This disconnect meant that signature validation failures were silently ignored, allowing the application to process forged SAML requests as if they were valid. An attacker could exploit this to either steal user data via a forged AuthnRequest or cause a denial of service by terminating user sessions with a forged LogoutRequest. The patch remediates this by altering validateSignature to throw an exception on failure, which aligns its behavior with the expectations of the calling functions, thereby ensuring that invalid signatures correctly halt execution.

Vulnerable functions

SAMLService.handleSSORequest

src/SSO/Service/SAMLService.php

This function processes SAML Single Sign-On (SSO) requests. It calls the `validateSignature` method but fails to check its return value. In the vulnerable version, `validateSignature` returns a string on validation failure instead of throwing an exception. This flaw allows the function to continue processing a request with an invalid or missing signature, enabling an attacker to forge an AuthnRequest and potentially steal user attributes.

SAMLService.handleSLORequest

src/SSO/Service/SAMLService.php

This function processes SAML Single Log-Out (SLO) requests. It calls the `validateSignature` method but discards its return value. Because `validateSignature` returned a string on failure instead of throwing an exception, the function proceeds to process requests with invalid signatures. This allows an attacker to forge a LogoutRequest to terminate any user's session, leading to a denial of service.

SAMLService.validateSignature

src/SSO/Service/SAMLService.php

This function contains the root logic flaw. It was designed to return a boolean value on success/failure but returned an error string upon signature validation failure. The functions calling it (`handleSSORequest` and `handleSLORequest`) did not check for this string return value and incorrectly assumed an exception would be thrown, leading to the bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.