A CSRF flaw in Admidio’s SSO client enable action allows an attacker to toggle the activation state of configured SAML or OIDC clients without performing token validation. Because the action is reached via a simple GET request and no CSRF token is checked, a malicious page can trick an authenticated administrator into visiting a crafted URL, silently disabling or re‑enabling an SSO client. Disabling an SSO client interrupts authentication for all relying‑party applications that depend on that client, effectively denying access for all users relying on the disrupted service.

Admidio, a popular open‑source user management solution, is affected in all releases older than version 5.0.10. Administrators who have not applied the 5.0.10 update are at risk of having their SSO configurations altered by an attacker.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits have been documented. The likely attack vector is a CSRF attack that requires an authenticated administrator to inadvertently click a malicious link; based on the description, it is inferred that the attacker needs only to persuade the admin to visit the crafted URL. Because the flaw permits silent alteration of authentication configuration, the impact can be significant for organizations heavily dependent on the affected SSO clients.