CVE-2026-47234
Received Received - Intake

Session Credential Exposure in Admidio via Debug Logging

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-47234
EUVD
EUVD-2026-57215

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
admidio admidio to 5.0.10 (exc)
admidio admidio 5.0.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Admidio versions before 5.0.10 involves sensitive credential exposure through debug logging. When debug logging is enabled, functions like Session::setCookie() and Session::start() log full cookie values and session IDs in cleartext. This includes both active session cookies and persistent auto-login cookies, which can be used to hijack sessions or gain unauthorized access.

Detection Guidance

Check Admidio debug logs for exposed session IDs or cookies. Look for entries containing 'Session::setCookie()' or 'Session::start()' with raw credential values. Commands: grep -r 'Session::setCookie()' /var/log/ or grep -r 'Session::start()' /var/log/. Ensure debug logging is disabled if enabled.

Impact Analysis

If you use Admidio versions before 5.0.10 with debug logging enabled, attackers with access to log files could extract session cookies and auto-login tokens. This allows them to impersonate users, hijack active sessions, or gain long-term unauthorized access to user accounts without needing credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy. Logging sensitive session cookies and auto-login tokens in cleartext exposes user credentials, which could lead to unauthorized access and data breaches. This conflicts with GDPR's data protection principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade Admidio to version 5.0.10 or later. Disable debug logging in the application configuration. Review and redact any logs containing sensitive session data. Rotate all session cookies and auto-login tokens if logs were exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47234. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart