CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.10 are vulnerable due to a lack of CSRF token validation in the `enable` function for SAML and OIDC clients, allowing an attacker to manipulate client states through crafted GET requests. This vulnerability can lead to unauthorized disabling or re-enabling of SSO clients, disrupting authentication for all dependent applications. Organizations using Admidio for user management, especially those relying on SSO integrations, should prioritize upgrading to version 5.0.10 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix.