An improper verification of cryptographic signature vulnerability in Admidio prior to version 5.0.9 allows unauthenticated remote attackers to bypass SAML authentication requirements, presenting a high risk to organizational data integrity.

This is an improper verification of cryptographic signature vulnerability, classified under CWE-347, affecting the SAML Identity Provider implementation. The application discards the return value of the validateSignature method, causing the smc_require_auth_signed configuration option to be ineffective against unauthenticated remote attackers.

The exploitation of this vulnerability allows unauthorized entities to process unsigned or invalidly-signed SAML authentication and logout requests, potentially leading to unauthorized access and severe integrity compromise of user management systems. With a CVSS score of 8.2, this high-severity flaw threatens organizational confidentiality and integrity by undermining core identity federation controls.

Immediate Action: Update the Admidio package to version 5.0.9 or later via Packagist to resolve the signature verification flaw.

Proactive Monitoring: Monitor authentication logs and SAML traffic for anomalous or unsigned request patterns indicating validation bypass attempts.

Compensating Controls: Implement strict Web Application Firewall rules to inspect and validate incoming SAML metadata and request signatures at the perimeter if immediate updating is impractical.

Public Exploit Available: No - As of the available data, there is no confirmed public exploit or weaponized module.

Given the high CVSS score and the presence of a proof-of-concept assessment, administrators must treat this vulnerability with urgency. Apply the official vendor update to version 5.0.9 immediately to restore proper cryptographic validation and secure the authentication boundary.