CVE-2026-57580 in authentik
Summary
by MITRE • 08/18/2026
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability described involves a critical authentication bypass flaw within the open-source identity provider authentik, specifically affecting inbound SAML sources configured with non-default user-matching modes such as USERNAME_LINK or EMAIL_LINK prior to versions 2026.2.6 and 2026.5.5. This issue stems from an inconsistency in how the application processes XML comments within the NameID element of a SAML assertion compared to its validation logic for signed assertions. In standard SAML workflows, the identity provider signs specific parts of the assertion to ensure integrity and authenticity. However, when authentik parses the incoming data, it interprets the presence of an XML comment as a signal to truncate the value used for user matching, effectively ignoring any text following the comment marker within that field. This behavior creates a divergence between the logical representation of the NameID used for account linkage and the actual cryptographic signature verification process.
An attacker possessing a valid account on the source identity provider can exploit this discrepancy by injecting an XML comment into their configured NameID value. By carefully crafting this input, the attacker ensures that the text preceding the comment matches the username or email address of a target victim within the authentik system. When the SAML assertion is processed, authentik truncates the NameID at the point of the injected comment for the purpose of user matching, thereby identifying the incoming request as belonging to the victim rather than the attacker. Crucially, because the XML comment does not alter the signed portion of the assertion in a way that breaks cryptographic verification, the signature remains valid and passes integrity checks. This allows the system to accept the authentication attempt without raising any security flags regarding tampering or invalid signatures.
The operational impact of this vulnerability is severe, resulting in complete account takeover for victims whose credentials are linked via USERNAME_LINK or EMAIL_LINK modes. The attacker gains full access to the victim's existing account without requiring knowledge of the victim's password or possession of the identity provider's private signing key. This bypasses traditional multi-factor authentication and credential-based security controls entirely. Furthermore, the malicious link persists across sessions; once the association is established through this truncation technique, subsequent logins by the attacker succeed automatically without needing to inject the XML comment again. This persistence ensures long-term unauthorized access until the underlying configuration or software version is updated.
This flaw aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials in the context of identity binding, as it exploits a failure to correctly validate input against expected formats before processing logical operations. From an ATT&CK perspective, this technique corresponds to T1078 Valid Accounts, where attackers leverage legitimate credentials to gain initial access, combined with aspects of T1556 Modify Authentication Process by manipulating the authentication flow itself through SAML assertion manipulation. The vulnerability is specific to inbound SAML configurations using non-default matching modes and does not affect sources utilizing the default unique-identifier matching mode or authentik's outbound SAML provider role, limiting the scope but highlighting a significant risk for organizations relying on custom user-matching strategies in their identity federation setups.
Mitigation requires immediate upgrading of the authentik instance to version 2026.2.6 or later, where this parsing inconsistency has been resolved. Administrators should also review existing inbound SAML source configurations and consider whether non-default matching modes are strictly necessary; if not, reverting to the default unique-identifier mode reduces exposure to similar input validation flaws. Additionally, implementing strict XML schema validation on incoming assertions can help prevent unexpected parsing behaviors related to comments or other markup elements that might interfere with logical processing of identity attributes. Regular auditing of user account linkages and monitoring for anomalous login patterns associated with specific source providers can further aid in detecting potential exploitation attempts before full compromise occurs.