The vulnerability in goauthentik's authentik product involves insufficient verification of data authenticity in the SAML source response processor (ResponseProcessor.parse()). Specifically, the Conditions element on SAML assertions—comprising NotBefore, NotOnOrAfter, and AudienceRestriction—is ignored, allowing attackers to replay expired assertions or use assertions meant for different service providers. This flaw affects versions prior to 2025.12.5 and 2026.2.3. The issue has been addressed and patched in these versions.

Exploitation of this vulnerability allows an attacker to replay expired SAML assertions or present assertions intended for other service providers, potentially bypassing authentication controls. This can lead to unauthorized access to services relying on authentik for identity verification. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality.

A fix is available and has been implemented in authentik versions 2025.12.5 and 2026.2.3. Users should upgrade to at least these versions to remediate the vulnerability. No additional mitigation actions are indicated by the vendor advisory.