CVE-2026-47234: Admidio Session ID and Auto-Login Cookie Exposure in Logs
Summary
CVE-2026-47234: Admidio writes session IDs and auto-login cookie values to application logs. Affects admidio/admidio versions < 5.0.10. Fixed in 5.0.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Admidio is an open-source application designed for managing user accounts and events. It provides features such as user registration, event management, and session handling. However, a significant vulnerability has been identified in version 5.0.9, where sensitive session identifiers and auto-login cookies are logged in plaintext when debug logging is enabled, exposing them to unauthorized access.
Vulnerability Detail
The vulnerability arises from the logging of sensitive information, specifically session IDs and auto-login cookie values, in the application logs. When debug logging is enabled, the methods Session::setCookie() and Session::start() log the full cookie values and current session IDs. This means that anyone with access to the logs can retrieve these credentials, leading to potential session hijacking or unauthorized access to user accounts. The logging of such sensitive information violates security best practices and expands the trust boundary to anyone who can read the logs.
How To Fix
Minimum fixed version
5.0.10
This is the first release that contains the fix.
composer require admidio/admidio:5.0.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the logging code to redact sensitive information before logging. Replace the logging statements in the Session.php file as follows:
$gLogger->info('Set Cookie!', [
'name' => $name,
'value' => '[redacted]',
'expire' => $expire,
'path' => $path,
'domain' => $domain,
'secure' => $secure,
'httpOnly' => $httpOnly,
'sameSite' => 'lax',
]);
$gLogger->info('Session Started!', [
'name' => $sessionName,
'limit' => $limit,
'path' => $path,
'domain' => $domain,
'secure' => $secure,
'httpOnly' => $httpOnly,
'sameSite' => 'lax',
'sessionId' => '[redacted]',
]);
Conclusion
The vulnerability CVE-2026-47234 in Admidio poses a significant risk by logging sensitive session information. It is crucial to update to the patched version 5.0.10 and implement logging best practices to mitigate this risk.
See every vulnerability recorded for admidio/admidio →
FAQ
CVE-2026-47234 is a vulnerability in Admidio that exposes session IDs and auto-login cookie values in application logs when debug logging is enabled.
If an attacker gains access to the logs, they can retrieve sensitive session information, potentially leading to session hijacking and unauthorized access to user accounts.
Admidio versions up to and including 5.0.9 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for admidio/admidio.
