This vulnerability occurs when Admidio’s Identity Provider accepts the AssertionConsumerServiceURL that appears in an incoming SAML AuthnRequest without validating it against the registered ACS URL stored for the target service provider. An attacker who knows a registered Service Provider’s Entity ID can send a crafted AuthnRequest that includes an arbitrary ACS URL. The IdP then returns a signed SAML response, which contains user identity attributes such as username, email address, roles, and profile fields, to the attacker‑controlled endpoint. This allows the attacker to capture the response and potentially impersonate the user or exfiltrate sensitive data. The flaw is an input‑validation weakness (CWE‑20) and improper URL handling (CWE‑601).

All installations of Admidio 5.0.x that are configured as a SAML Identity Provider and use the default SSO module are impacted. Versions prior to 5.0.9 run the vulnerable code. Users who authenticate through the IdP are at risk.

The vulnerability scores an 8.2 on the CVSS scale, indicating high severity. An exploitable path exists over the network, as any remote party can send a manipulated AuthnRequest to the IdP endpoint. The EPSS metric is unavailable, and the issue is not listed in the CISA KEV catalog. Attackers can therefore read privileged user information without needing prior authentication or additional privileges, making the risk of exploitation significant for exposed IdPs.