Cross-site Request Forgery (CSRF) Affecting admidio/admidio package, versions <5.0.10
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-ADMIDIOADMIDIO-17112493
- published31 May 2026
- disclosed29 May 2026
- creditoffset
Introduced: 29 May 2026
NewCVE-2026-47229 (opens in a new tab)How to fix?
Upgrade admidio/admidio to version 5.0.10 or higher.
Overview
admidio/admidio is a free open source user management system for websites of organizations and groups.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the enable process in modules/sso/clients.php when handling SAML or OIDC client state changes without validating a CSRF token. An attacker can disable or re-enable SSO clients by tricking an authenticated administrator into visiting a malicious page that issues a crafted GET request.