CVE-2026-47234: 
PHP vulnerability analysis and mitigation

CVE-2026-47234 is a sensitive information disclosure vulnerability in Admidio, an open-source user management system, where debug logging exposes live session credentials in plaintext application logs. Specifically, Session::setCookie() logs full cookie values and Session::start() logs the current session ID, including both the active session cookie (ADMIDIO_*_SESSION_ID) and the persistent auto-login cookie (ADMIDIO_*_AUTO_LOGIN_ID). The vulnerability affects Admidio versions up to and including v5.0.9, and was patched in v5.0.10. It was first published on May 25, 2026, and added to the GitHub Advisory Database on May 29, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory).

The root cause is classified under CWE-532 (Insertion of Sensitive Information into Log File) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In src/Session/Entity/Session.php, the $gLogger->info() calls at lines 533–540 and 615–617 pass raw cookie values and session IDs as log context arrays without any redaction or masking. This behavior is triggered whenever debug logging is enabled in Admidio, which is a non-default but administrator-configurable setting. Exploitation requires local access to the log sink (e.g., log files, log aggregation systems, or backup archives) and elevated privileges to enable or read debug logs, making the attack vector local with high privilege requirements (GitHub Advisory, Admidio Advisory).

The primary impact is a high confidentiality loss: any actor with read access to the application log files, log backups, or external log aggregation outputs can extract live bearer-style credentials — both short-lived session IDs and long-lived auto-login tokens. These credentials can be replayed directly to impersonate authenticated users, enabling session hijacking or persistent account access for the duration of the cookie lifetime. There is no integrity or availability impact, but the exposure effectively turns the log file into a credential store accessible to anyone in the log access trust boundary (GitHub Advisory).

No public exploit kit or weaponized tooling has been reported for this vulnerability. A proof-of-concept script was included in the advisory, demonstrating that a login with auto_login=1 causes both ADMIDIO_*_AUTO_LOGIN_ID and ADMIDIO_*_SESSION_ID values to appear in cleartext in the application log. Exploitation requires that debug logging be enabled and that the attacker have local access to the log output — conditions that limit opportunistic exploitation. There is no evidence of in-the-wild exploitation, no CISA KEV catalog listing, and no EPSS score data available at this time (GitHub Advisory, Admidio Advisory).

1. Prerequisite — Enable Debug Logging: Gain administrative access to the Admidio instance and enable debug logging in the application configuration.
2. Trigger Session Creation: Log in to the Admidio application with the auto_login=1 parameter set to generate both a session cookie and a persistent auto-login cookie.
3. Access Log Files: Obtain read access to the Admidio application log file (e.g., via local file system access, log aggregation platform, or backup archive).
4. Extract Credentials: Search the log for entries matching Admidio.INFO: Set Cookie! (containing ADMIDIO_*_AUTO_LOGIN_ID and ADMIDIO_*_SESSION_ID values) and Admidio.INFO: Session Started! (containing sessionId in plaintext).
5. Replay Credentials: Use the extracted session ID or auto-login cookie value in HTTP requests to the Admidio instance to impersonate the target user without needing their password (GitHub Advisory).

• Logs: Admidio application log entries containing Admidio.INFO: Set Cookie! with a value field populated (non-redacted), referencing cookie names matching ADMIDIO_*_SESSION_ID or ADMIDIO_*_AUTO_LOGIN_ID.
• Logs: Admidio application log entries containing Admidio.INFO: Session Started! with a non-empty sessionId field in src/Session/Entity/Session.php at line 617.
• File System: Presence of Admidio log files (e.g., in the application log directory) containing plaintext session token strings matching the pattern of PHP session IDs (26-character alphanumeric strings).
• File System: Log backup archives or exported log files accessible to non-administrative users that contain the above log patterns.
• Network: Unexpected authenticated HTTP requests to Admidio using session cookies that do not correspond to active browser sessions, potentially indicating cookie replay from harvested log data (GitHub Advisory).

Upgrade Admidio to version 5.0.10 or later, which resolves the issue by redacting sensitive values before logging. As an interim workaround, disable debug logging in the Admidio configuration to prevent session IDs and cookie values from being written to logs. Additionally, restrict read access to log files and log aggregation outputs to only trusted administrative accounts, and rotate any session tokens and auto-login cookies that may have been exposed in existing logs. The advisory recommends replacing raw values with '[redacted]' in the $gLogger->info() calls for both setCookie() and start() methods (Admidio Advisory).