CVE-2026-47234: Admidio/admidio Admidio Writes Session IDs And Vulnerability

Q: What is CVE-2026-47234?

CVE-2026-47234 is a security vulnerability in Admidio/admidio involving Admidio writes session IDs and auto-login cookie values to application logs under CWE-532: Insertion of Sensitive Information into Log File.

Q: Which Admidio/admidio versions are affected?

Affected versions include releases prior to 5.0.10 across affected packages: admidio/admidio.

Q: What version fixes CVE-2026-47234?

Upgrading to 5.0.10 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is admidio/admidio affected?

Yes, admidio/admidio is affected in releases prior to 5.0.10. Upgrade your dependency to 5.0.10 or later.

Q: What is the CVSS score of CVE-2026-47234?

CVE-2026-47234 has a CVSS v3.1 base score of 4.4 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Q: What CWE is associated with CVE-2026-47234?

CVE-2026-47234 is classified under CWE-532: Insertion of Sensitive Information into Log File (The product writes sensitive information to a log file.).

Q: How can I check Packagist dependencies for CVE-2026-47234?

Run the dependency tree command: 'inspect dependencies for admidio/admidio'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-mch8-wf3h-6x88

CVSS 4.4

CWE-532 CWE-200

Published 2026-05-29

Advisory Summary

CVE-2026-47234 is a MODERATE (CVSS 4.4) admidio writes session ids and vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting Admidio/admidio libraries in the Packagist ecosystem. The issue involves admidio writes session ids and auto-login cookie values to application logs. Remediation is available by upgrading affected packages to version 5.0.10.

CVE-2026-47234 at a Glance

CVE Identifier CVE-2026-47234

GHSA Identifier GHSA-mch8-wf3h-6x88

Severity MODERATE

CVSS v3.1 Base Score 4.4

CWE Classification CWE-532: Insertion of Sensitive Information into Log File

Affected Product Admidio/admidio

Package Ecosystem Packagist

Published Date 2026-05-29

Last Updated 2026-05-29

Security Impact

CVSS: 4.4

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required High (PR:H)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

How to Fix CVE-2026-47234

To remediate this vulnerability, upgrade all affected Admidio/admidio dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

admidio/admidio fixed: 5.0.10

Upgrade admidio/admidio to 5.0.10

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for admidio/admidio

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-47234, inspect your project dependencies for Admidio/admidio:

inspect dependencies for admidio/admidio

Analyze the terminal output to locate any version of Admidio/admidio in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.0.10), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File, where the product writes sensitive information to a log file. In Admidio/admidio, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary When debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. ## Vulnerable Code Links - https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L533-L540 - https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L615-L617 ## Vulnerable Code ```php // src/Session/Entity/Session.php $gLogger->info('Set Cookie!', array( 'name' => $name, 'value' => $value, 'expire' => $expire, 'path' => $path, 'domain' => $domain, 'secure' => $secure, 'httpOnly' => $httpOnly, 'sameSite' => 'lax' )); ... session_start(); $gLogger->info('Session Started!', array( 'name' => $sessionName, 'limit' => $limit, 'path' => $path, 'domain' => $domain, 'secure' => $secure, 'httpOnly' => $httpOnly, 'sameSite' => 'lax', 'sessionId' => session_id() )); ``` ## What Does The Code Mean Every time Admidio sets a cookie, it writes the raw cookie value to the application log. When a session starts, it writes the active session identifier too. ## Why The Code Is Vulnerable Session IDs and persistent auto-login values are credentials. Logging them turns the log file into a credential store and expands the trust boundary to anyone who can read logs, backups, or external log aggregation outputs. ## Verification Environment - Application: Admidio `v5.0.9` - Runtime: Dockerized Admidio + MariaDB on `http://localhost:18080` - Validation mode: real deployed application, not isolated unit tests ## Steps To Reproduce 1. Enable Admidio debug logging. 2. Log in with `auto_login=1` enabled. 3. Inspect the generated application log. 4. Observe that the log contains both the `ADMIDIO_*_AUTO_LOGIN_ID` value and the `ADMIDIO_*_SESSION_ID` value in cleartext. ## PoC Script ```python from helpers import login, new_session, save_json def main(): session = new_session() result = login(session, "admin", "AdminPass123!", auto_login=True) save_json("session_logging_login.json", result) if __name__ == "__main__": main() ``` ## PoC Output ```text { "cookies": { "ADMIDIO_admidio_adm_AUTO_LOGIN_ID": "2%3AnO2BhCdRgFUMKT46e2EzS79Inf4oWiLWzLnX9Ko5", "ADMIDIO_admidio_adm_SESSION_ID": "iga3ujr67cti6s7btnuhecte67" }, "csrf": "y41CaDdEO7RKug5FIRWO2Dx8w7KVQZ", "json": { "status": "success", "url": "http://localhost:18080/modules/overview.php" }, "status_code": 200 } 5191:[2026-04-30 20:57:59.555213] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"8224iqk8aqcsb0062d0c3f1ish"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 5291:[2026-04-30 20:57:59.575756] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"8224iqk8aqcsb0062d0c3f1ish"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 5480:[2026-04-30 20:57:59.623872] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"733jf4j6po8m6b1g7glgaghfsg"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 5624:[2026-04-30 20:57:59.663760] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"733jf4j6po8m6b1g7glgaghfsg"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 5655:[2026-04-30 20:57:59.788831] Admidio.INFO: Set Cookie! {"name":"ADMIDIO_admidio_adm_SESSION_ID","value":"ovnk3hhpj5829dj63pjk4i7k8b","expire":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":533,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"setCookie"} 5680:[2026-04-30 20:57:59.795443] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"ovnk3hhpj5829dj63pjk4i7k8b"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 5815:[2026-04-30 20:57:59.838697] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"ovnk3hhpj5829dj63pjk4i7k8b"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 5839:[2026-04-30 20:58:09.374182] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"dvrl2qf92skdeimh77ruglr4ga"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 5983:[2026-04-30 20:58:09.423217] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"dvrl2qf92skdeimh77ruglr4ga"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6014:[2026-04-30 20:58:09.550875] Admidio.INFO: Set Cookie! {"name":"ADMIDIO_admidio_adm_SESSION_ID","value":"2th9qe9etfiis6nujdqpkfd9hv","expire":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":533,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"setCookie"} 6039:[2026-04-30 20:58:09.557823] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"2th9qe9etfiis6nujdqpkfd9hv"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6273:[2026-04-30 20:58:19.171185] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"k50i1toh4491o6v0htliv2kafs"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6417:[2026-04-30 20:58:19.212351] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"k50i1toh4491o6v0htliv2kafs"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6448:[2026-04-30 20:58:19.337758] Admidio.INFO: Set Cookie! {"name":"ADMIDIO_admidio_adm_SESSION_ID","value":"4emiuth6i2fc1ho17nahf6n52g","expire":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":533,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"setCookie"} 6473:[2026-04-30 20:58:19.346804] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"4emiuth6i2fc1ho17nahf6n52g"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6605:[2026-04-30 20:58:19.390909] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"4emiuth6i2fc1ho17nahf6n52g"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6635:[2026-04-30 20:58:19.409216] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"4emiuth6i2fc1ho17nahf6n52g"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6676:[2026-04-30 20:58:31.002317] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"aegildsksa0i5184igdk12pdg3"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6820:[2026-04-30 20:58:31.045064] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"aegildsksa0i5184igdk12pdg3"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 6853:[2026-04-30 20:58:31.174884] Admidio.INFO: Set Cookie! {"name":"ADMIDIO_admidio_adm_SESSION_ID","value":"9vsc7c5qv9cr4cavugitg6i2l3","expire":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":533,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"setCookie"} 6878:[2026-04-30 20:58:31.184031] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"9vsc7c5qv9cr4cavugitg6i2l3"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 7010:[2026-04-30 20:58:40.393679] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"nr7mssfl6eupo9d2pboea7hmb2"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 7154:[2026-04-30 20:58:40.438503] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"nr7mssfl6eupo9d2pboea7hmb2"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 7185:[2026-04-30 20:58:40.564244] Admidio.INFO: Set Cookie! {"name":"ADMIDIO_admidio_adm_SESSION_ID","value":"sts5aqfsvqghtl6bfq79a3ap2t","expire":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":533,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"setCookie"} 7210:[2026-04-30 20:58:40.571305] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"sts5aqfsvqghtl6bfq79a3ap2t"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 7342:[2026-04-30 20:58:40.611506] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"sts5aqfsvqghtl6bfq79a3ap2t"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 7414:[2026-04-30 21:01:44.898211] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"dcgm8ebt3hkhmvvk9n860r6i5n"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 7558:[2026-04-30 21:01:44.940724] Admidio.INFO: Session Started! {"name":"ADMIDIO_admidio_adm_SESSION_ID","limit":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax","sessionId":"dcgm8ebt3hkhmvvk9n860r6i5n"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":617,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"start"} 7591:[2026-04-30 21:01:45.066694] Admidio.INFO: Set Cookie! {"name":"ADMIDIO_admidio_adm_AUTO_LOGIN_ID","value":"2:nO2BhCdRgFUMKT46e2EzS79Inf4oWiLWzLnX9Ko5","expire":1809118905,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":533,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"setCookie"} 7596:[2026-04-30 21:01:45.068352] Admidio.INFO: Set Cookie! {"name":"ADMIDIO_admidio_adm_SESSION_ID","value":"iga3ujr67cti6s7btnuhecte67","expire":0,"path":"/","domain":false,"secure":false,"httpOnly":true,"sameSite":"lax"} {"file":"/opt/app-root/src/src/Session/Entity/Session.php","line":533,"class":"Admidio\\Session\\Entity\\Session","callType":"::","function":"setCookie"} ``` ## Impact Any actor with log access can replay or abuse current session IDs and auto-login cookies, leading to session hijacking or long-lived account access depending on deployment and cookie lifetime. ## Remediation And Suggestions Never log raw session identifiers or cookie values. Replace them with fixed labels or redact most of the value before logging. ```php $gLogger->info('Set Cookie!', [ 'name' => $name, 'value' => '[redacted]', 'expire' => $expire, 'path' => $path, 'domain' => $domain, 'secure' => $secure, 'httpOnly' => $httpOnly, 'sameSite' => 'lax', ]); $gLogger->info('Session Started!', [ 'name' => $sessionName, 'limit' => $limit, 'path' => $path, 'domain' => $domain, 'secure' => $secure, 'httpOnly' => $httpOnly, 'sameSite' => 'lax', 'sessionId' => '[redacted]', ]); ```

CVE-2026-47234 Affected Admidio/admidio Versions

1 component(s)

Fixed Versions:

5.0.10

Product / Package	Ecosystem	Affected Versions	Fixed Version
admidio/admidio	Packagist	< 5.0.10	5.0.10

References

GitHub Advisory / Wiki ADVISORY

https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88

Admidio/admidio Source Repository REPOSITORY

https://github.com/Admidio/admidio

Frequently Asked Questions

What is CVE-2026-47234?

CVE-2026-47234 is a security vulnerability in Admidio/admidio involving Admidio writes session IDs and auto-login cookie values to application logs under CWE-532: Insertion of Sensitive Information into Log File.

Which Admidio/admidio versions are affected?

Affected versions include releases prior to 5.0.10 across affected packages: admidio/admidio.

What version fixes CVE-2026-47234?

Upgrading to 5.0.10 (or the latest patched release for your respective branch) resolves the vulnerability.

Is admidio/admidio affected?

Yes, admidio/admidio is affected in releases prior to 5.0.10. Upgrade your dependency to 5.0.10 or later.

What is the CVSS score of CVE-2026-47234?

CVE-2026-47234 has a CVSS v3.1 base score of 4.4 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

What CWE is associated with CVE-2026-47234?

CVE-2026-47234 is classified under CWE-532: Insertion of Sensitive Information into Log File (The product writes sensitive information to a log file.).

How can I check Packagist dependencies for CVE-2026-47234?

Run the dependency tree command: 'inspect dependencies for admidio/admidio'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mch8-wf3h-6x88",
  "modified" : "2026-05-29T22:07:52Z",
  "published" : "2026-05-29T22:07:52Z",
  "aliases" : [ "CVE-2026-47234" ],
  "summary" : "Admidio writes session IDs and auto-login cookie values to application logs",
  "details" : "## Summary\n\nWhen debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs.\n\n## Vulnerable Code Links\n\n- https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L533-L540\n- https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L615-L617\n\n## Vulnerable Code\n\n```php\n// src/Session/Entity/Session.php\n$gLogger->info('Set Cookie!', array(\n'name' => $name,\n'value' => $value,\n'expire' => $expire,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax'\n));\n...\nsession_start();\n$gLogger->info('Session Started!', array(\n'name' => $sessionName,\n'limit' => $limit,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax',\n'sessionId' => session_id()\n));\n```\n\n\n## What Does The Code Mean\n\nEvery time Admidio sets a cookie, it writes the raw cookie value to the application log. When a session starts, it writes the active session identifier too.\n\n## Why The Code Is Vulnerable\n\nSession IDs and persistent auto-login values are credentials. Logging them turns the log file into a credential store and expands the trust boundary to anyone who can read logs, backups, or external log aggregation outputs.\n\n## Verification Environment\n\n- Application: Admidio `v5.0.9`\n- Runtime: Dockerized Admidio + MariaDB on `http://localhost:18080`\n- Validation mode: real deployed application, not isolated unit tests\n\n## Steps To Reproduce\n\n1. Enable Admidio debug logging.\n2. Log in with `auto_login=1` enabled.\n3. Inspect the generated application log.\n4. Observe that the log contains both the `ADMIDIO_*_AUTO_LOGIN_ID` value and the `ADMIDIO_*_SESSION_ID` value in cleartext.\n\n\n## PoC Script\n\n```python\nfrom helpers import login, new_session, save_json\n\n\ndef main():\nsession = new_session()\nresult = login(session, \"admin\", \"AdminPass123!\", auto_login=True)\nsave_json(\"session_logging_login.json\", result)\n\n\nif __name__ == \"__main__\":\nmain()\n```\n\n## PoC Output\n\n```text\n{\n  \"cookies\": {\n\"ADMIDIO_admidio_adm_AUTO_LOGIN_ID\": \"2%3AnO2BhCdRgFUMKT46e2EzS79Inf4oWiLWzLnX9Ko5\",\n\"ADMIDIO_admidio_adm_SESSION_ID\": \"iga3ujr67cti6s7btnuhecte67\"\n  },\n  \"csrf\": \"y41CaDdEO7RKug5FIRWO2Dx8w7KVQZ\",\n  \"json\": {\n\"status\": \"success\",\n\"url\": \"http://localhost:18080/modules/overview.php\"\n  },\n  \"status_code\": 200\n}\n\n5191:[2026-04-30 20:57:59.555213] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"8224iqk8aqcsb0062d0c3f1ish\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5291:[2026-04-30 20:57:59.575756] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"8224iqk8aqcsb0062d0c3f1ish\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5480:[2026-04-30 20:57:59.623872] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"733jf4j6po8m6b1g7glgaghfsg\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5624:[2026-04-30 20:57:59.663760] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"733jf4j6po8m6b1g7glgaghfsg\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5655:[2026-04-30 20:57:59.788831] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"ovnk3hhpj5829dj63pjk4i7k8b\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n5680:[2026-04-30 20:57:59.795443] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"ovnk3hhpj5829dj63pjk4i7k8b\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5815:[2026-04-30 20:57:59.838697] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"ovnk3hhpj5829dj63pjk4i7k8b\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5839:[2026-04-30 20:58:09.374182] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dvrl2qf92skdeimh77ruglr4ga\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5983:[2026-04-30 20:58:09.423217] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dvrl2qf92skdeimh77ruglr4ga\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6014:[2026-04-30 20:58:09.550875] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"2th9qe9etfiis6nujdqpkfd9hv\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n6039:[2026-04-30 20:58:09.557823] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"2th9qe9etfiis6nujdqpkfd9hv\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6273:[2026-04-30 20:58:19.171185] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"k50i1toh4491o6v0htliv2kafs\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6417:[2026-04-30 20:58:19.212351] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"k50i1toh4491o6v0htliv2kafs\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6448:[2026-04-30 20:58:19.337758] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"4emiuth6i2fc1ho17nahf6n52g\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n6473:[2026-04-30 20:58:19.346804] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"4emiuth6i2fc1ho17nahf6n52g\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6605:[2026-04-30 20:58:19.390909] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"4emiuth6i2fc1ho17nahf6n52g\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6635:[2026-04-30 20:58:19.409216] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"4emiuth6i2fc1ho17nahf6n52g\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6676:[2026-04-30 20:58:31.002317] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"aegildsksa0i5184igdk12pdg3\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6820:[2026-04-30 20:58:31.045064] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"aegildsksa0i5184igdk12pdg3\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6853:[2026-04-30 20:58:31.174884] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"9vsc7c5qv9cr4cavugitg6i2l3\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n6878:[2026-04-30 20:58:31.184031] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"9vsc7c5qv9cr4cavugitg6i2l3\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7010:[2026-04-30 20:58:40.393679] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"nr7mssfl6eupo9d2pboea7hmb2\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7154:[2026-04-30 20:58:40.438503] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"nr7mssfl6eupo9d2pboea7hmb2\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7185:[2026-04-30 20:58:40.564244] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"sts5aqfsvqghtl6bfq79a3ap2t\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n7210:[2026-04-30 20:58:40.571305] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"sts5aqfsvqghtl6bfq79a3ap2t\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7342:[2026-04-30 20:58:40.611506] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"sts5aqfsvqghtl6bfq79a3ap2t\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7414:[2026-04-30 21:01:44.898211] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dcgm8ebt3hkhmvvk9n860r6i5n\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7558:[2026-04-30 21:01:44.940724] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dcgm8ebt3hkhmvvk9n860r6i5n\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7591:[2026-04-30 21:01:45.066694] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_AUTO_LOGIN_ID\",\"value\":\"2:nO2BhCdRgFUMKT46e2EzS79Inf4oWiLWzLnX9Ko5\",\"expire\":1809118905,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n7596:[2026-04-30 21:01:45.068352] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"iga3ujr67cti6s7btnuhecte67\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n```\n\n## Impact\n\nAny actor with log access can replay or abuse current session IDs and auto-login cookies, leading to session hijacking or long-lived account access depending on deployment and cookie lifetime.\n\n## Remediation And Suggestions\n\nNever log raw session identifiers or cookie values. Replace them with fixed labels or redact most of the value before logging.\n\n```php\n$gLogger->info('Set Cookie!', [\n'name' => $name,\n'value' => '[redacted]',\n'expire' => $expire,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax',\n]);\n\n$gLogger->info('Session Started!', [\n'name' => $sessionName,\n'limit' => $limit,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax',\n'sessionId' => '[redacted]',\n]);\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "admidio/admidio"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.0.10"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.0.9"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Admidio/admidio"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-532" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-29T22:07:52Z",
    "nvd_published_at" : null
  }
}

CVSS V3

4.4 MODERATE