Detections
Analytics

SCA: security update for admidio/admidio (GHSA-9xx5-cv6j-x533)

medium Tenable Self-Hosted Container Security Plugin ID 440973

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection
 endpoint (/modules/sso/index.php/oidc/introspect) always returns {"active": true} for every request,
 regardless of whether a valid token is provided, whether the token is expired, revoked, or completely
 fabricated. The endpoint performs no authentication of the calling resource server and no validation of
 the submitted token. Any resource server that relies on this introspection endpoint to validate access
 tokens will accept all requests as authorized, enabling complete authentication bypass. Additionally, the
 OIDC token revocation endpoint (/oidc/revoke) returns {"revoked": true} without actually revoking any
 token, preventing resource servers from invalidating compromised credentials. This issue has been patched
 in version 5.0.9. (CVE-2026-41671)

Solution

Update the admidio/admidio library and its related packages to version 5.0.9 or later.

See Also

https://github.com/advisories/GHSA-9xx5-cv6j-x533

Plugin Details

Severity: Medium

ID: 440973

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 4/30/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.27

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-41671

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/29/2026

Vulnerability Publication Date: 4/29/2026

Reference Information

CVE: CVE-2026-41671

cwe: CWE-287