Prior to release 5.0.10, Admidio records full cookie values and current session IDs in application logs when debug logging is enabled. This exposes bearer‑style session identifiers and persistent auto‑login tokens to anyone who can read the logs, creating a risk of credential theft and unauthorized account access. The weakness is a confidentiality breach and improper logging of sensitive data. The CVSS score of 4.4 indicates a moderate but not critical severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS is not provided. The exploitable condition is the presence of debug logging and accessible log files; an attacker with such access could directly read the tokens.

Admidio user management applications in versions up to and including 5.0.9 that have debug logging enabled. The affected component is the Session handling module of Admidio.*

Because the vulnerability requires read access to the log sink, the attack vector is limited to users or processes that can retrieve logs, such as compromised server administrators or compromised web services. The CVSS score of 4.4 reflects a moderate exploitation risk, but the lack of an EPSS score and absence from the KEV list suggest it is not widely exploited. The impact, while significant for affected users, remains bounded to the application’s log files and the session tokens logged therein.