CVE-2026-69092: Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.11 - Configuration
Update Admidio to 5.0.11 or later to address the reflected XSS in the SSO/SAML endpoint that echoes unencoded exception messages; ensure SAML Issuer/LightSaml parameters are not reflected unencoded in HTTP responses.
Admidio SSO/SAML endpoint SAML Issuer elements and/or LightSaml library parameters = Validate/sanitize and ensure any echoed exception messages are encoded before being returned in the HTTP response
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69092?
The severity of CVE-2026-69092 is rated medium with a score of 6.5.
How do I fix CVE-2026-69092?
To fix CVE-2026-69092, upgrade Admidio to version 5.0.11 or later.
What type of vulnerability is CVE-2026-69092?
CVE-2026-69092 is a reflected cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2026-69092?
Unauthenticated attackers can exploit CVE-2026-69092 by injecting arbitrary JavaScript.
In which component is CVE-2026-69092 found?
CVE-2026-69092 is found in the SSO/SAML endpoint of Admidio before version 5.0.11.