TI-2026-30188 Aliases CVE-2026-41671 GHSA-9xx5-cv6j-x533

Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation

MEDIUM 63CWE-287Published 2026-05-07 · Updated 2026-05-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) always returns {"active": true} for every request, regardless of whether a valid token is provided, whether the token is expired, revoked, or completely fabricated. The endpoint performs no authentication of the calling resource server and no validation of the submitted token. Any resource server that relies on this introspection endpoint to validate access tokens will accept all requests as authorized, enabling complete authentication bypass. Additionally, the OIDC token revocation endpoint (/oidc/revoke) returns {"revoked": true} without actually revoking any token, preventing resource servers from invalidating compromised credentials. This issue has been patched in version 5.0.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00323 25th percentileScored 2026-11-07

Fix Fixed admidio (Admidio): 5.0.9admidio/admidio (Packagist): 5.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Admidio	admidio	before 5.0.9	5.0.9	Patch available	CNA
—	admidio/admidio (Packagist)	before 5.0.9	5.0.9	Patch available	GHSA-9xx5-cv6j-x533

admidio VendorAdmidio Affected before 5.0.9 Fixed in 5.0.9 Patch available CNA
admidio/admidio (Packagist) Vendor— Affected before 5.0.9 Fixed in 5.0.9 Patch available GHSA-9xx5-cv6j-x533

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:admidio:admidio::::::::	—	—	Admidio

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

Fix · CNA admidio (Admidio) Fixed in 5.0.9
Fix · GHSA-9xx5-cv6j-x533 admidio/admidio (Packagist) Fixed in 5.0.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41671
2026-10-03 Alias added: GHSA-9xx5-cv6j-x533

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41671

Other 3

TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1

See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences