Admidio versions before 5.0.11 have a reflected cross-site scripting (XSS) vulnerability in the SSO/SAML endpoint. This vulnerability occurs because unencoded exception messages are echoed in HTTP responses. Unauthenticated attackers can exploit this by injecting arbitrary JavaScript via SAML Issuer elements or LightSaml library parameters, potentially executing code in users' browsers and hijacking sessions.