Admidio’s OIDC introspection endpoint always replies with {"active": true} for any request, ignoring the token’s validity, expiration, revocation status, or authenticity. The same flaw applies to the revocation endpoint, which always reports a token as revoked even when no revocation occurs. Consequently, any resource server that trusts this endpoint will accept every bearer token, allowing attackers to authenticate with any credentials and gain unauthorized access. The weakness is a classic example of missing authentication, classified as CWE‑287.

The issue affects Admidio 5.0.x releases prior to 5.0.9. Systems using this open‑source user management application and relying on Admidio’s OIDC endpoints for token validation are subject to risk.

With a CVSS score of 6.8 the vulnerability has moderate severity. No EPSS score is reported, and the flaw is not listed in the CISA KEV catalog, suggesting no widely documented exploitation. Based on the description, the attacker does not need any privileges within Admidio; an external resource server that trusts the introspection endpoint can simply query it, receiving a positive response for any token. Thus the likely attack vector is remote, requiring only network reach to the endpoint to achieve authentication bypass.