The vulnerability in authentik's WS-Federation provider involves improper validation of the user-supplied wreply parameter. Instead of correctly parsing the URL, the system uses a raw string prefix check, which can be bypassed by supplying a crafted URL on a different origin that still passes the prefix check (e.g., https://portal.example.com.evil.tld/). This leads to an open redirect scenario where the victim's browser posts the signed WS-Federation login response to an attacker-controlled endpoint. This flaw is classified as CWE-601 (Open Redirect). The issue was patched in authentik version 2026.2.3.

An attacker can exploit this vulnerability to redirect a victim's browser to an attacker-controlled site during the WS-Federation login flow. This could result in the victim's browser sending signed login responses to the attacker, potentially enabling unauthorized access or session hijacking. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, but with low confidentiality and integrity impact.

A fix is available in authentik version 2026.2.3. Users should upgrade to this version or later to remediate the vulnerability. No other mitigation guidance is provided or required as the issue is resolved by the official patch.