The vulnerability arises because Admidio’s SAML Identity Provider implementation fails to honor the result of its signature validation routine. The validateSignature() method returns error strings when a SAML AuthnRequest or LogoutRequest is unsigned or contains an invalid signature, but the caller ignores this return value. Consequently, requests that should have been rejected are treated as valid, enabling an attacker to craft forged AuthnRequests or LogoutRequests and cause the system to authenticate a user or terminate a session without proper authorization. This flaw is a classic example of CWE‑347, Improper Validation of Cryptographic Signature, and permits unauthorized identity delegation with potential elevation of privileges.

Admidio, the open‑source user‑management solution, is affected in all releases prior to 5.0.9. The issue is fixed in version 5.0.9 and later, so any deployment still running 5.0.8 or earlier is vulnerable.

The flaw has a CVSS score of 8.2 and is not listed in the CISA KEV catalog. Because the vulnerability is triggered remotely by sending a crafted SAML request to the SSO endpoint, an attacker can execute it over the network without needing local access. No exploit code or public proof of concept has been reported, and the EPSS score is not available, but the potential for widespread impact and the high severity score indicate that the risk is significant if the system is exposed to the internet or to untrusted partners.