CVE-2026-80428 is a critical unauthenticated PHP object injection vulnerability in the ILIAS e-learning platform. The Shibboleth back-channel logout endpoint (shib_logout.php) is exempt from authentication and calls PHP unserialize() on every row of the session table without class restrictions. An attacker can inject a malicious serialized object into the session table via the LTI authentication entry point, which is also exempt from authentication. When the logout endpoint processes sessions, destructors of instantiated objects execute arbitrary logic. A bundled class writes attacker-controlled JSON content to an attacker-chosen file path under the web root during destruction, enabling remote code execution as the web server user. The attack chain is fully unauthenticated and requires no prior access. Fixed in ILIAS versions 9.22, 10.10, and 11.3 by removing the logout-notification implementation from the endpoint.