{"id":"CVE-2026-47234","title":"Admidio is an open-source user management solution","summary":"Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment t…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-200","CWE-532"],"published":"2026-08-12","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:55:04.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47234","references":[{"url":"https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L533-L540","label":"security-advisories@github.com"},{"url":"https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L615-L617","label":"security-advisories@github.com"},{"url":"https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.0013,"epssPercentile":0.03018,"ingestedAt":"2026-09-09T21:22:45.530Z","slug":"CVE-2026-47234","body":"## Overview\n\nAdmidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}