8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41670

CVE-2026-41670: Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value directly from incoming SAML AuthnRequest messages as the destination for the SAML response, without validating it against the registered ACS URL (smc_acs_url) stored in the database for the corresponding service provider client. An attacker who knows the Entity ID of a registered SP client can craft a SAML AuthnRequest with an arbitrary AssertionConsumerServiceURL, causing the IdP to send the signed SAML response -- containing user identity attributes (login name, email, roles, profile fields) -- to an attacker-controlled URL. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41670

CVE-2026-41670:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Admidio's SAML Identity Provider (IdP) implementation failed to validate the AssertionConsumerServiceURL provided in SAML AuthnRequests. This URL dictates where the SAML response, containing the user's identity and attributes, should be sent. The root cause is improper input validation (CWE-20), leading to an open redirect (CWE-601) vulnerability. An attacker could craft a SAML AuthnRequest with a legitimate Service Provider (SP) Entity ID but an AssertionConsumerServiceURL pointing to their own server. When a logged-in Admidio user is tricked into initiating the SSO flow with this malicious request, the Admidio IdP would generate a valid, signed SAML assertion and send it to the attacker's URL. The attacker could then use this assertion to impersonate the victim at the legitimate SP. The analysis of the patch commit 3c013a9ae9bc60b08f579349f1a79f657358b034 confirms this. The changes in src/SSO/Service/SAMLService.php introduce strict validation in both the main handleSSORequest function and the errorResponse function, ensuring that the AssertionConsumerServiceURL from the request is compared against the one registered in the SP client's configuration before being used. This effectively closes the open redirect and prevents the information disclosure and impersonation attack.

Vulnerable functions

SAMLService::handleSSORequest

src/SSO/Service/SAMLService.php

The `handleSSORequest` function was vulnerable because it extracted the `AssertionConsumerServiceURL` from an incoming SAML AuthnRequest and used it to set the destination for the SAML response without validation. An attacker could provide a malicious URL, causing the application to send the victim's SAML assertion (containing identity and profile information) to an attacker-controlled server. The patch adds a check to ensure the provided URL matches the one registered for the service provider.

SAMLService::errorResponse

src/SSO/Service/SAMLService.php

The `errorResponse` function was also vulnerable. In certain error scenarios, it would use the `AssertionConsumerServiceURL` from the incoming request as the destination for the error response. This could be exploited similarly to the `handleSSORequest` vulnerability, allowing an attacker to redirect sensitive information. The patch removes this logic and ensures that only the registered ACS URL from the client's configuration is used as the destination.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.