Authentication Bypass Vulnerability in Admidio User Management Solution

CVE-2026-41671

What is CVE-2026-41671?

Admidio, an open-source user management solution, contains a significant vulnerability affecting its OIDC token introspection and revocation endpoints. Versions prior to 5.0.9 do not correctly validate tokens, leading to a scenario where any request to the introspection endpoint returns a status of active without checking the token's validity. This flaw allows unauthorized access as any resource server using this endpoint can misinterpret the token's legitimacy. Equally concerning is the revocation endpoint, which fails to revoke tokens as intended, allowing compromised credentials to remain usable indefinitely. Users are strongly encouraged to upgrade to version 5.0.9 to mitigate these serious security risks.

References