CVE-2026-94613 in Authentik
Summary
by MITRE • 09/24/2026
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within authentik, an open-source identity provider solution, represents a significant availability risk stemming from improper input validation of Security Assertion Markup Language messages. Specifically, the flaw allows an unauthenticated attacker to exploit weaknesses in the SAML processing logic used by both the Identity Provider and SAML Source roles. By submitting carefully crafted malformed SAML assertions or requests, an adversary can trigger exceptions within the application's worker processes that handle endpoints such as /application/saml/ and /source/saml/. This exploitation does not require authentication credentials, making it particularly dangerous for public-facing identity services where attackers can probe from any location on the internet. The core technical failure lies in the inability of the SAML parser or handler to gracefully manage syntactically incorrect or structurally invalid XML data, leading to unhandled exceptions that crash the specific worker thread responsible for processing the request.
From an operational perspective, this vulnerability directly impacts service availability through a Denial of Service mechanism. When a worker process terminates due to the malformed input, it is typically restarted by the application's orchestration layer or container runtime. While these restarts preserve database-backed sessions and do not result in immediate data loss, they introduce latency and processing overhead. More critically, if an attacker continues to send malicious messages at scale, the constant cycle of worker termination and restart consumes system resources such as CPU cycles and memory allocation for process management. This sustained abuse can lead to a situation where legitimate traffic is consistently dropped or experiences severe delays because the available workers are either crashed or busy restarting. The impact is localized to SAML-based authentication flows; other protocol implementations supported by authentik remain unaffected, but given that many enterprise environments rely heavily on SAML for single sign-on access, this represents a critical availability gap.
This incident aligns with Common Weakness Enumeration category CWE-20 Improper Input Validation, as the application fails to adequately sanitize or validate incoming SAML data before processing it. Furthermore, in terms of offensive security frameworks, this vulnerability facilitates attacks categorized under MITRE ATT&CK technique T1498 Network Denial of Service, specifically involving resource exhaustion through service disruption. The attacker leverages the system's own recovery mechanisms against itself to create a persistent denial-of-service condition without needing elevated privileges or valid user accounts. This highlights the importance of implementing robust error handling and input validation layers at the protocol parsing stage to prevent malformed data from reaching critical business logic that could cause process instability.
To mitigate this vulnerability, organizations must immediately upgrade authentik to version 2026.2.7, 2026.5.7, or 2026.8.2, which contain the necessary patches for input validation and error handling improvements. Until an upgrade is feasible, administrators should consider implementing network-level controls such as rate limiting on SAML endpoints to throttle the volume of requests a single IP address can submit within a given timeframe. Additionally, deploying Web Application Firewalls with specific rulesets designed to detect malformed XML or suspicious SAML structures can help filter out malicious payloads before they reach the application server. It is also advisable to monitor worker process restart logs and CPU usage metrics on servers hosting authentik instances to quickly identify potential abuse patterns indicative of this exploitation attempt. Regular security assessments focusing on identity provider configurations are recommended to ensure that all supported protocols, including SAML, OIDC, and LDAP, are hardened against similar input-based attacks.