CVE-2026-69092CWE-79cross-site-scripting

CVE-2026-69092

Medium · published August 3, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-03T18:16Z
References (3)
https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf · [email protected]https://www.vulncheck.com/advisories/admidio-before-reflected-xss-via-sso-saml-endpoint · [email protected]https://github.com/Admidio/admidio/security/advisories/GHSA-7jxv-38f3-6xgf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 AUG 13:20Z
    Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint
    cvelistv5