Medium severity6.8GHSA Advisory· Published May 7, 2026· Updated May 7, 2026
CVE-2026-42194
CVE-2026-42194
Description
Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
admidio/admidioPackagist | < 5.0.9 | 5.0.9 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-hcjj-chvw-fmw9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42194ghsaADVISORY
- github.com/Admidio/admidio/commit/f6b7a966abe4d75e9f707d665d7b4b5570e3185aghsaWEB
- github.com/Admidio/admidio/releases/tag/v5.0.9nvdWEB
- github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73ghsaWEB
- github.com/Admidio/admidio/security/advisories/GHSA-hcjj-chvw-fmw9nvdWEB
News mentions
0No linked articles in our index yet.