Admidio, an open‑source user‑management platform, contains a CSRF‑vulnerable action that allows administrators to export a PKCS#12 bundle with the private key and certificate. The CSRF validation routine is commented out in versions prior to 5.0.10, meaning a malicious website can send a forged POST on behalf of an authenticated admin and retrieve the private key. The flaw gives an attacker the ability to compromise the confidentiality of the private key used by the SSO system.

All released Admidio versions up to 5.0.9 are affected, including the 5.0.9 release that is widely deployed. The issue resides in the modules/sso/keys.php file. Version 5.0.10 includes a fix that reinstates CSRF validation.

The vulnerability scores as a moderate CVSS 4.3 and has no current EPSS, and it is not listed in the CISA KEV catalog. Exploitation requires an active administrator session and a cross‑site POST request, making the attack possible when an admin is logged in and visits a malicious page. Attackers can extract the private key, compromising the integrity and confidentiality of all signed SSO tokens.