EUVD-2026-352228

fkie_cve-2026-47229

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix.

GHSA-xg76-5qj2-2hhv — Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Affected: Packagist: admidio/admidio

## Summary

`modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it.

## Details

### Vulnerable Code

`modules/sso/clients.php:84-115` — the file's other branches each begin with `SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);`, but `case 'enable':` does not:

```php case 'delete_oidc': // check the CSRF token of the form against the session token SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);

$oidcService = new OIDCService($gDb, $gCurrentUser); $client = $oidcService->getClientFromUUID($getClientUUID); $client->delete(); echo json_encode(array('status' => 'success')); break;

case 'enable': // <- no CSRF validation $enabled = admFuncVariableIsValid($_GET, 'enabled', 'boolean'); $client = new SAMLClient($gDb); $client->readDataByUuid($getClientUUID); if ($client->isNewRecord()) { // Not a SAML record, so try OIDC: $client = new OIDCClient($gDb); $client->readData…

Most recent entries from all

EUVD-2026-352228

fkie_cve-2026-47229

GHSA-xg76-5qj2-2hhv — Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation