{"id":"CVE-2026-47234","aliases":["GHSA-mch8-wf3h-6x88"],"url":"https://o3.security/vulnerability/CVE-2026-47234","summary":"Admidio writes session IDs and auto-login cookie values to application logs","details":"## Summary\n\nWhen debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs.\n\n## Vulnerable Code Links\n\n- https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L533-L540\n- https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L615-L617\n\n## Vulnerable Code\n\n```php\n// src/Session/Entity/Session.php\n$gLogger->info('Set Cookie!', array(\n'name' => $name,\n'value' => $value,\n'expire' => $expire,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax'\n));\n...\nsession_start();\n$gLogger->info('Session Started!', array(\n'name' => $sessionName,\n'limit' => $limit,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax',\n'sessionId' => session_id()\n));\n```\n\n\n## What Does The Code Mean\n\nEvery time Admidio sets a cookie, it writes the raw cookie value to the application log. When a session starts, it writes the active session identifier too.\n\n## Why The Code Is Vulnerable\n\nSession IDs and persistent auto-login values are credentials. Logging them turns the log file into a credential store and expands the trust boundary to anyone who can read logs, backups, or external log aggregation outputs.\n\n## Verification Environment\n\n- Application: Admidio `v5.0.9`\n- Runtime: Dockerized Admidio + MariaDB on `http://localhost:18080`\n- Validation mode: real deployed application, not isolated unit tests\n\n## Steps To Reproduce\n\n1. Enable Admidio debug logging.\n2. Log in with `auto_login=1` enabled.\n3. Inspect the generated application log.\n4. Observe that the log contains both the `ADMIDIO_*_AUTO_LOGIN_ID` value and the `ADMIDIO_*_SESSION_ID` value in cleartext.\n\n\n## PoC Script\n\n```python\nfrom helpers import login, new_session, save_json\n\n\ndef main():\nsession = new_session()\nresult = login(session, \"admin\", \"AdminPass123!\", auto_login=True)\nsave_json(\"session_logging_login.json\", result)\n\n\nif __name__ == \"__main__\":\nmain()\n```\n\n## PoC Output\n\n```text\n{\n  \"cookies\": {\n\"ADMIDIO_admidio_adm_AUTO_LOGIN_ID\": \"2%3AnO2BhCdRgFUMKT46e2EzS79Inf4oWiLWzLnX9Ko5\",\n\"ADMIDIO_admidio_adm_SESSION_ID\": \"iga3ujr67cti6s7btnuhecte67\"\n  },\n  \"csrf\": \"y41CaDdEO7RKug5FIRWO2Dx8w7KVQZ\",\n  \"json\": {\n\"status\": \"success\",\n\"url\": \"http://localhost:18080/modules/overview.php\"\n  },\n  \"status_code\": 200\n}\n\n5191:[2026-04-30 20:57:59.555213] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"8224iqk8aqcsb0062d0c3f1ish\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5291:[2026-04-30 20:57:59.575756] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"8224iqk8aqcsb0062d0c3f1ish\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5480:[2026-04-30 20:57:59.623872] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"733jf4j6po8m6b1g7glgaghfsg\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5624:[2026-04-30 20:57:59.663760] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"733jf4j6po8m6b1g7glgaghfsg\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5655:[2026-04-30 20:57:59.788831] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"ovnk3hhpj5829dj63pjk4i7k8b\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n5680:[2026-04-30 20:57:59.795443] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"ovnk3hhpj5829dj63pjk4i7k8b\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5815:[2026-04-30 20:57:59.838697] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"ovnk3hhpj5829dj63pjk4i7k8b\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5839:[2026-04-30 20:58:09.374182] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dvrl2qf92skdeimh77ruglr4ga\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n5983:[2026-04-30 20:58:09.423217] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dvrl2qf92skdeimh77ruglr4ga\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6014:[2026-04-30 20:58:09.550875] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"2th9qe9etfiis6nujdqpkfd9hv\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n6039:[2026-04-30 20:58:09.557823] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"2th9qe9etfiis6nujdqpkfd9hv\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6273:[2026-04-30 20:58:19.171185] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"k50i1toh4491o6v0htliv2kafs\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6417:[2026-04-30 20:58:19.212351] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"k50i1toh4491o6v0htliv2kafs\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6448:[2026-04-30 20:58:19.337758] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"4emiuth6i2fc1ho17nahf6n52g\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n6473:[2026-04-30 20:58:19.346804] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"4emiuth6i2fc1ho17nahf6n52g\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6605:[2026-04-30 20:58:19.390909] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"4emiuth6i2fc1ho17nahf6n52g\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6635:[2026-04-30 20:58:19.409216] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"4emiuth6i2fc1ho17nahf6n52g\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6676:[2026-04-30 20:58:31.002317] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"aegildsksa0i5184igdk12pdg3\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6820:[2026-04-30 20:58:31.045064] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"aegildsksa0i5184igdk12pdg3\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n6853:[2026-04-30 20:58:31.174884] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"9vsc7c5qv9cr4cavugitg6i2l3\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n6878:[2026-04-30 20:58:31.184031] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"9vsc7c5qv9cr4cavugitg6i2l3\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7010:[2026-04-30 20:58:40.393679] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"nr7mssfl6eupo9d2pboea7hmb2\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7154:[2026-04-30 20:58:40.438503] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"nr7mssfl6eupo9d2pboea7hmb2\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7185:[2026-04-30 20:58:40.564244] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"sts5aqfsvqghtl6bfq79a3ap2t\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n7210:[2026-04-30 20:58:40.571305] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"sts5aqfsvqghtl6bfq79a3ap2t\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7342:[2026-04-30 20:58:40.611506] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"sts5aqfsvqghtl6bfq79a3ap2t\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7414:[2026-04-30 21:01:44.898211] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dcgm8ebt3hkhmvvk9n860r6i5n\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7558:[2026-04-30 21:01:44.940724] Admidio.INFO: Session Started! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"limit\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\",\"sessionId\":\"dcgm8ebt3hkhmvvk9n860r6i5n\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":617,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"start\"}\n7591:[2026-04-30 21:01:45.066694] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_AUTO_LOGIN_ID\",\"value\":\"2:nO2BhCdRgFUMKT46e2EzS79Inf4oWiLWzLnX9Ko5\",\"expire\":1809118905,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n7596:[2026-04-30 21:01:45.068352] Admidio.INFO: Set Cookie! {\"name\":\"ADMIDIO_admidio_adm_SESSION_ID\",\"value\":\"iga3ujr67cti6s7btnuhecte67\",\"expire\":0,\"path\":\"/\",\"domain\":false,\"secure\":false,\"httpOnly\":true,\"sameSite\":\"lax\"} {\"file\":\"/opt/app-root/src/src/Session/Entity/Session.php\",\"line\":533,\"class\":\"Admidio\\\\Session\\\\Entity\\\\Session\",\"callType\":\"::\",\"function\":\"setCookie\"}\n```\n\n## Impact\n\nAny actor with log access can replay or abuse current session IDs and auto-login cookies, leading to session hijacking or long-lived account access depending on deployment and cookie lifetime.\n\n## Remediation And Suggestions\n\nNever log raw session identifiers or cookie values. Replace them with fixed labels or redact most of the value before logging.\n\n```php\n$gLogger->info('Set Cookie!', [\n'name' => $name,\n'value' => '[redacted]',\n'expire' => $expire,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax',\n]);\n\n$gLogger->info('Session Started!', [\n'name' => $sessionName,\n'limit' => $limit,\n'path' => $path,\n'domain' => $domain,\n'secure' => $secure,\n'httpOnly' => $httpOnly,\n'sameSite' => 'lax',\n'sessionId' => '[redacted]',\n]);\n```","published":"2026-08-12T13:58:11.339Z","modified":"2026-09-11T03:30:49.393257807Z","cvss":{"score":4.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.0013,"percentile":0.03084,"asOf":"2026-08-20"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"admidio/admidio","fixedVersion":"5.0.10"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L533-L540"},{"type":"WEB","url":"https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L615-L617"},{"type":"ADVISORY","url":"https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47234.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47234"},{"type":"PACKAGE","url":"https://github.com/Admidio/admidio"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T03:30:49.393257807Z"}}