CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
An attacker can trick an administrator into disabling SSO clients via CSRF, breaking authentication for downstream applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47229?
CVE-2026-47229 is a medium-severity vulnerability in admidio, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix.
Weakness: CWE-352
Which versions are affected by CVE-2026-47229?
2 open source packages ship an affected version, including admidio/admidio.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 5.0.10 |
admidio/admidio Packagist | All versions | 5.0.10 |
How do I fix CVE-2026-47229?
Upgrade admidio/admidio to 5.0.10 or later.
Is CVE-2026-47229 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47229 exists.
Sources
Also known as GHSA-xg76-5qj2-2hhv.