An improper input validation vulnerability in Admidio prior to version 5.0.9 allows unauthenticated remote attackers to redirect signed SAML responses containing sensitive user attributes to arbitrary external URLs via crafted authentication requests.

This is an improper input validation and open redirect vulnerability residing in the SAML Single Sign-On module, which can be triggered by unauthenticated attackers supplying arbitrary Assertion Consumer Service URLs in incoming SAML request messages.

A successful exploit allows malicious actors to intercept sensitive user identity attributes, including login names, email addresses, roles, and profile fields, leading to credential exposure and potential account compromise. With a CVSS score of 8.2, this high-severity flaw threatens user data confidentiality and organization trust, requiring prompt remediation to prevent data exfiltration.

Immediate Action: Update Admidio to version 5.0.9 or later to properly validate Assertion Consumer Service URLs against registered service provider configurations.

Proactive Monitoring: Monitor authentication and SSO logs for anomalous SAML request patterns containing unexpected Assertion Consumer Service URLs.

Compensating Controls: Implement strict network egress filtering and Web Application Firewalls to inspect and block outbound SAML traffic destined for unapproved endpoints if patching is delayed.

Public Exploit Available: No - unknown

Given the high severity rating and potential exposure of sensitive user identity attributes, organizations must prioritize patching this vulnerability. Administrators should upgrade immediately to version 5.0.9 to secure the SAML Single Sign-On module against redirection attacks.