The vulnerability in Admidio prior to version 5.0.11 is a reflected cross-site scripting (CWE-79) issue located in the SSO/SAML endpoint. It arises from the application echoing unencoded exception messages back to the HTTP response, allowing unauthenticated attackers to inject malicious JavaScript through SAML Issuer elements or parameters used by the LightSaml library. Successful exploitation can lead to execution of arbitrary code in the context of the victim's browser and session hijacking. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An attacker can execute arbitrary JavaScript in the context of users' browsers by injecting malicious code into the SSO/SAML endpoint. This can lead to session hijacking and unauthorized actions performed on behalf of the user. The vulnerability affects confidentiality and integrity but does not impact availability.

A fix is available in Admidio version 5.0.11. Users should upgrade to version 5.0.11 or later to remediate this vulnerability. No vendor advisory was provided, so patch status is inferred from the version mentioned in the description. Until patched, avoid exposing the vulnerable SSO/SAML endpoint to untrusted users or networks if possible.