CVE-2026-69092
Received Received - Intake

Reflected XSS in Admidio via SAML Issuer Parameter

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69092
EUVD
EUVD-2026-52285

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
admidio admidio to 5.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-69092 is a reflected cross-site scripting (XSS) vulnerability in Admidio versions before 5.0.11. It occurs in the SSO/SAML endpoint where exception messages are echoed unencoded to the HTTP response. Attackers can exploit this by injecting malicious JavaScript via SAML Issuer elements or LightSaml library parameters, allowing them to execute arbitrary code in users' browsers and hijack sessions.

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the SSO/SAML endpoint for unencoded exception messages or JavaScript injection attempts in SAML Issuer elements or LightSaml parameters. Check for unusual user-agent strings or payloads in SAML requests.

Impact Analysis

Unauthenticated attackers can exploit this vulnerability to inject malicious scripts into web pages viewed by users. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of users. Users with access to Admidio systems are at risk of browser-based attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. Organizations using vulnerable Admidio versions may face compliance violations, potential fines, and reputational damage due to data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Admidio to version 5.0.11 or later to address the reflected XSS vulnerability. If immediate upgrade is not possible, restrict access to the SSO/SAML endpoint and implement input validation for SAML parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69092. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart