Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
Date: 2026-04
Affected: composer/admidio/admidio
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-41656
CVE-2026-41657
CVE-2026-41658
CVE-2026-41661
CVE-2026-41669
CVE-2026-41670
CWE: CWE-20
CWE-22
CWE-347
CWE-601
CWE-79
CWE-862
CWE-863
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)

## Summary The SAML IdP implementation in Admidio's SSO module uses the `AssertionConsumerServiceURL` value directly from incoming SAML AuthnRequest messages as the destination for the SAML response, without validating it against the registered ACS URL (`smc_acs_url`) stored in the database for the corresponding service provider client. An attacker who knows the Entity ID of a registered SP client can craft a SAML AuthnRequest with an arbitrary `AssertionConsumerServiceURL`, causing the IdP to send the signed SAML response -- containing user identity attributes (login name, email, roles, profile fields) -- to an attacker-controlled URL. ## Details The vulnerability is in `src/SSO/Service/SAMLService.php`, in `handleSSORequest()` at lines 439-465: ```php // Line 439: ACS URL extracted directly from the AuthnRequest (attacker-controlled) $clientACS = $request->getAssertionConsumerServiceURL(); // ... // Line 456: Used as the Destination of the SAML Response $response->setDestination($clientACS); // Lines 463-465: Also used as the Recipient in SubjectConfirmationData $subjectConfirmationData = new \LightSaml\Model\Assertion\SubjectConfirmationData(); $subjectConfirmationData ->setRecipient($clientACS) // Required recipient URL ``` There is no code that compares `$clientACS` against the client's registered `smc_acs_url` column value. The SAML 2.0 specification and OASIS security considerations explicitly require IdPs to verify that the AssertionConsumerServiceURL matc


Mitigations:

Architectural layers (MAESTRO):