CVE-2026-69092

6.9 mediumEPSS 0.4%

Medium (6.9). EPSS 0.4% chance of exploitation in the next 30 days.

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-08-03
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf
https://www.vulncheck.com/advisories/admidio-before-reflected-xss-via-sso-saml-endpoint
https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf

Check your stack JSON