goauthentik up to 2026.2.2 URL parser wreply redirect

Summaryinfo

A vulnerability, which was classified as problematic, has been found in goauthentik authentik up to 2026.2.2. The affected element is an unknown function of the component URL parser. The manipulation of the argument wreply leads to redirect. This vulnerability is listed as CVE-2026-41569. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in goauthentik authentik up to 2026.2.2 and classified as problematic. This issue affects an unknown functionality of the component URL parser. The manipulation of the argument wreply with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin that passes the check (e.g. https://portal.example.com.evil.tld/), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure. This issue has been patched in version 2026.2.3.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-41569 since 04/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 2026.2.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• goauthentik

Name

• authentik

Version

• 2026.2.0
• 2026.2.1
• 2026.2.2

Website

• Product: https://github.com/goauthentik/authentik/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion