Medium severity4.4GHSA Advisory· Published Aug 12, 2026· Updated Aug 12, 2026

CVE-2026-47234

Description

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie() logs full cookie values and Session::start() logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
admidio/admidioPackagist	< 5.0.10	5.0.10

Affected products

Admidio/AdmidioGHSA
Range: <= 5.0.9

Patches

Vulnerability mechanics

References

News mentions

Admidio: Nine CVEs Disclosed Together — IDOR, CSRF, and Auth Bypass Flaws
Vypr Intelligence · May 29, 2026

Severity

MediumCVSS v3.1

4.4/ 10

Attack vector: Local
Complexity: Low
Privileges: High
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected

Source repo: github.com/Admidio/admidio

EPSS

Probability of exploitation in the next 30 days.

0.13%

VYPR risk score

Composite of severity, exploitation, and reach.

0.22low

cvss	0.286
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-532
Insertion of Sensitive Information into Log File

CVE ID

CVE-2026-47234

Credits

0
0x2face
reporter · ghsa
0
00xCanelo
coordinator · ghsa
0
0xheg3zy
coordinator · ghsa
0
0xreizouko
coordinator · ghsa
A
ADHAM-KHAIRY
coordinator · ghsa
B
BabaYaga0x01
coordinator · ghsa
S
spect3r1
coordinator · ghsa