CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.10 are vulnerable due to debug logging that exposes full cookie values, including active session and persistent auto-login cookies, in log files. This can allow unauthorized users with access to the logs to recover sensitive session credentials, potentially leading to session hijacking. Organizations using Admidio should prioritize upgrading to version 5.0.10 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.