CVE-2026-57580 is a critical vulnerability in the open-source identity provider authentik. It arises from an interpretation conflict (CWE-436) in how authentik processes XML comments within the NameID element of inbound SAML assertions when configured with non-default USERNAME_LINK or EMAIL_LINK user-matching modes. An attacker who controls an account on the source identity provider can inject an XML comment that truncates the NameID value used by authentik, while the signed assertion remains valid. This allows the attacker to link their external identity to a victim's existing account, effectively taking over the victim's account without needing their password or the identity provider's private key. The malicious link persists across logins. The vulnerability does not impact the default unique-identifier matching mode or authentik's outbound SAML Provider role. The issue is resolved in authentik versions 2026.2.6 and 2026.5.5.

Successful exploitation allows an attacker with an account on the source identity provider to fully take over a victim's account in authentik without requiring the victim's password or the identity provider's private key. This is achieved by injecting a crafted XML comment in the NameID that causes truncation and identity binding to the victim's username or email. The attacker gains persistent access as the malicious link remains valid for subsequent logins.

Upgrade authentik to version 2026.2.6 or 2026.5.5 or later, where this vulnerability is fixed. Until patched, avoid configuring inbound SAML Sources with USERNAME_LINK or EMAIL_LINK user-matching modes if possible. No other mitigations are specified. Patch status is confirmed fixed in these versions.