What’s Vulnerable › Vulnerabilities

CVE-2026-47234: Admidio writes session IDs and auto-login cookie values to application logs

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-09-09
• Weakness: CWE-200

Description

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.

Affected products

• admidio: before 5.0.10

References

• https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L533-L540
• https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L615-L617
• https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88

Get alerted when CVE-2026-47234 or the next vulnerability affects your stack