CVE-2026-47234: 
PHP Análise e mitigação de vulnerabilidades

CVE-2026-47234 is a sensitive information exposure vulnerability in Admidio, an open-source user management solution, where debug logging inadvertently records live session credentials in plaintext. Specifically, Session::setCookie() logs full cookie values and Session::start() logs the current session ID, exposing both the active session cookie (ADMIDIO_*_SESSION_ID) and the persistent auto-login cookie (ADMIDIO_*_AUTO_LOGIN_ID) to anyone with access to the log sink. All versions prior to 5.0.10 are affected. The vulnerability was published on May 29, 2026, and assigned CVSS v3.1 base score of 4.4 (Medium) (Github Advisory).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In src/Session/Entity/Session.php, the setCookie() method at lines 533–540 passes the raw $value parameter — which contains the full cookie token — directly to $gLogger->info(), and the start() method at line 615–617 similarly logs session_id() in cleartext after calling session_start(). Exploitation requires local access with high privileges (e.g., access to the server's filesystem, log aggregation system, or backup storage where Admidio application logs are stored), making this a local attack vector with low complexity once log access is obtained (Github Advisory, Admidio Security Advisory).

An actor with read access to the Admidio application log files — including server administrators, log aggregation platform users, or anyone with access to backups — can extract live bearer-style credentials (session IDs and auto-login tokens) directly from the logs. These credentials can be replayed to hijack active user sessions or, in the case of the persistent auto-login cookie (valid for up to one year), maintain long-lived unauthorized account access without requiring the victim's password. There is no integrity or availability impact; the risk is confined to confidentiality of user session credentials (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.013–0.015% (3rd percentile), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for high privileges and local access to the log sink, significantly limiting the attacker pool to insiders or those who have already compromised adjacent systems (Github Advisory).

1. Gain log access: Obtain read access to the Admidio application log file on the server (e.g., via a compromised admin account, direct filesystem access, a misconfigured log aggregation platform, or access to a backup containing logs).
2. Confirm debug logging is enabled: Verify that Admidio's debug logging is active, as the sensitive data is only written when this mode is on.
3. Search logs for session credentials: Grep or search the log file for entries matching Admidio.INFO: Set Cookie! or Admidio.INFO: Session Started! to locate lines containing ADMIDIO_*_SESSION_ID and ADMIDIO_*_AUTO_LOGIN_ID values in cleartext JSON format.
4. Extract credential values: Parse the JSON log entries to retrieve the raw cookie values, e.g., "value":"iga3ujr67cti6s7btnuhecte67" for session IDs or "value":"2:nO2BhCdRgFUMKT46e2EzS79Inf4oWiLWzLnX9Ko5" for auto-login tokens.
5. Replay credentials: Craft an HTTP request to the Admidio instance with the extracted cookie(s) set in the Cookie header to impersonate the victim user and gain unauthorized access to their account (Admidio Security Advisory).

• Logs: Admidio application log entries containing Admidio.INFO: Set Cookie! with a "value" field populated with a non-empty token string, or Admidio.INFO: Session Started! with a "sessionId" field — both indicating debug logging is active and credentials are being recorded.
• Logs: Unexpected access to Admidio log files from accounts or processes that do not normally read application logs.
• File System: Copies or exfiltration of Admidio log files (e.g., admidio.log) to unusual locations or external destinations.
• Network: Authenticated Admidio sessions originating from IP addresses inconsistent with the legitimate user's known access patterns, potentially indicating session replay using harvested cookies (Admidio Security Advisory).

Upgrade Admidio to version 5.0.10 or later, which contains the fix that redacts sensitive cookie values and session IDs from log output. As an interim workaround if upgrading immediately is not possible, disable debug logging in Admidio to prevent session credentials from being written to logs. Additionally, restrict read access to Admidio log files and any log aggregation outputs to only those accounts that strictly require it, and rotate all active sessions and auto-login tokens if log files may have been accessed by unauthorized parties (Github Advisory).