SAML Implementation Vulnerability in Admidio User Management Solution

CVE-2026-41669

What is CVE-2026-41669?

Admidio, an open-source user management solution, has a vulnerability in its SAML Identity Provider implementation prior to version 5.0.9. This flaw arises from the failure to properly validate SAML AuthnRequests and LogoutRequests, allowing unsigned or improperly signed requests to be processed without appropriate checks. The validateSignature() method, designed to throw exceptions on errors, incorrectly discards return values, which means that the smc_require_auth_signed configuration setting becomes ineffective. This poses a significant risk as it enables the system to inadvertently accept invalid signatures, compromising the integrity of user authentication processes. A fix has been implemented in version 5.0.9 to address this issue.

References