CVE-2026-94612 in Authentik
Summary
by MITRE • 09/24/2026
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within authentik prior to versions 2026.2.7, 2026.5.7, and 2026.8.2 represents a critical failure in the security controls governing SAML-based authentication flows. Authentik functions as an open-source identity provider that manages user identities and access policies for various service providers through protocols such as Security Assertion Markup Language (SAML). In this specific context, the flaw resides within the implementation of SAML Sources, which are configurations used to trust assertions from external identity providers. While the system correctly validates the cryptographic signature and checks the validity period of incoming assertions, it fails to enforce two crucial security properties: issuer binding and assertion uniqueness. This gap allows an attacker who possesses a valid SAML assertion intended for a different service provider or one that was previously accepted in an earlier session to reuse it against this specific authentik instance.
From a technical perspective, the core issue is a lack of audience restriction validation combined with the absence of replay protection mechanisms. When a SAML identity provider issues an assertion, it typically includes metadata indicating which service providers are authorized recipients for that token. The vulnerable version of authentik does not verify whether the intended recipient in the assertion matches the specific SAML Source configuration attempting to process it. Consequently, assertions meant for other applications can be accepted as valid login attempts. Furthermore, the system lacks a mechanism to track or record previously processed assertions. This omission means there is no defense against replay attacks, where an attacker captures a legitimate authentication token and resubmits it multiple times to gain unauthorized access without needing to crack credentials or exploit additional software bugs.
The operational impact of this vulnerability is severe, as it directly compromises the integrity of user authentication. An unauthenticated actor who obtains such a valid assertion can impersonate any user named within that assertion. This capability effectively bypasses multi-factor authentication and password-based security controls if those were part of the original login flow at the external identity provider. The attacker gains full access to the victim's account, potentially leading to unauthorized data access, privilege escalation, or lateral movement within connected systems depending on the permissions associated with that user identity. It is important to note that this vulnerability specifically affects SAML Sources; configurations acting as SAML Providers or other source types such as LDAP or OAuth are not impacted by this specific flaw, limiting the scope of exploitation primarily to environments relying heavily on external SAML-based trust relationships.
This vulnerability aligns with Common Weakness Enumeration (CWE) standards, particularly CWE-287 which describes Improper Authentication due to insufficient authentication checks, and CWE-345 regarding Insufficient Verification of Data Authenticity. In terms of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Credential Access and Defense Evasion, specifically allowing an adversary to leverage valid credentials or tokens without detection through replay attacks. To mitigate this risk, organizations must upgrade authentik to version 2026.2.7, 2026.5.7, or later versions where these checks have been implemented. Until the update is applied, administrators should consider implementing network-level controls such as IP whitelisting for SAML endpoints if feasible, although this does not fully mitigate the risk of token theft from legitimate sessions. Additionally, reviewing logs for unusual patterns in assertion acceptance may help detect ongoing exploitation attempts while patches are being deployed.