CVE-2026-69092

EUVD-2026-52285
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
admidioadmidio
𝑥
< 5.0.11
CNA
Common Weakness Enumeration
References
https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf
https://www.vulncheck.com/advisories/admidio-before-reflected-xss-via-sso-saml-endpoint
https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf