Skip to content
Threat Feed

Tag

Acs-Bypass

1 brief RSS
medium advisory

Admidio SAML Assertion Consumer Service (ACS) URL Validation Bypass

Admidio's SAML IdP implementation in its SSO module is vulnerable to sending SAML responses to unvalidated Assertion Consumer Service URLs, allowing an attacker to craft a SAML AuthnRequest with an arbitrary AssertionConsumerServiceURL, causing the IdP to send the signed SAML response, containing user identity attributes, to an attacker-controlled URL, enabling impersonation of the victim user on the legitimate SP by replaying the SAML assertion.

admidio saml sso acs-bypass cve-2026-41670
2r 2t 2i