MEDIUM
Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
Published Aug 3, 2026
6.9
MEDIUMCVSS 4.0
EPSS 0.38%
Description
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.
Affected products
-
Affected
- ≥ 0, < 5.0.11
Unaffected
- 5.0.11
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52285 Advisory
- https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf exploitvendor-advisory
- https://www.vulncheck.com/advisories/admidio-before-reflected-xss-via-sso-saml-endpoint third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52285 | Advisory | |
| https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf | exploitvendor-advisory | |
| https://www.vulncheck.com/advisories/admidio-before-reflected-xss-via-sso-saml-endpoint | third-party-advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Aug 3, 2026
Updated Aug 3, 2026
Reserved Aug 3, 2026
Link CVE-2026-69092
CISA Vulnrichment
Updated Aug 3, 2026
Red Hat
No data
GitHub
No data