CVE-2026-41671

Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) always returns {"active": true} for every request, regardless of whether a valid token is provided, whether the token is expired, revoked, or completely fabricated. The endpoint performs no authentication of the calling resource server and no validation of the submitted token. Any resource server that relies on this introspection endpoint to validate access tokens will accept all requests as authorized, enabling complete authentication bypass. Additionally, the OIDC token revocation endpoint (/oidc/revoke) returns {"revoked": true} without actually revoking any token, preventing resource servers from invalidating compromised credentials. This issue has been patched in version 5.0.9.

• CWE-287

• https://github.com/Admidio/admidio/releases/tag/v5.0.9
• https://github.com/Admidio/admidio/security/advisories/GHSA-9xx5-cv6j-x533

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41665Integer overflow in scratch buffer initialization size calcu…6.1
• CVE-2026-41666Integer overflow in tensor copy size calculation in Samsung …6.6
• CVE-2026-41667Integer overflow in constant tensor data size calculation in…6.6
• CVE-2026-41669Admidio is an open-source user management solution. Prior to…8.2
• CVE-2026-4167A vulnerability was determined in Belkin F9K1122 1.00.33. Th…8.8
• CVE-2026-41670Admidio is an open-source user management solution. Prior to…8.2
• CVE-2026-41672xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-41673xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-41674xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-41675xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…8.7
• CVE-2026-41676rust-openssl provides OpenSSL bindings for the Rust programm…7.5
• CVE-2026-41677rust-openssl provides OpenSSL bindings for the Rust programm…9.1