CVE-2026-94612: CWE-287: Improper Authentication in goauthentik authentik
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
AI Analysis
Technical Summary
The goauthentik authentik identity provider has an authentication bypass vulnerability (CWE-287) in its SAML Source implementation prior to versions 2026.2.7, 2026.5.7, and 2026.8.2. While the SAML Source verifies the signature and validity period of assertions, it does not verify that the identity provider issued the assertion specifically for that Source or in response to a login request from that Source. Additionally, it does not track previously accepted assertions, allowing replay attacks. An unauthenticated attacker with a valid assertion can reuse or repurpose it to authenticate as the user named in the assertion. This vulnerability affects only SAML Sources and has been addressed in the fixed versions.
Potential Impact
An unauthenticated attacker who obtains a valid SAML assertion can authenticate as the user named in that assertion by reusing it or using an assertion intended for a different service provider. This can lead to unauthorized access and impersonation within the authentik system. The vulnerability does not affect other source types or SAML Providers.
Mitigation Recommendations
This vulnerability is fixed in goauthentik authentik versions 2026.2.7, 2026.5.7, and 2026.8.2. Users should upgrade to one of these versions or later to remediate the issue. No additional mitigation is required once upgraded.
CVE-2026-94612: CWE-287: Improper Authentication in goauthentik authentik
Description
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
CVSS v3.1
Score 7.4high
Affected software
goauthentik
authentik
pkg:github/goauthentik/authentikRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The goauthentik authentik identity provider has an authentication bypass vulnerability (CWE-287) in its SAML Source implementation prior to versions 2026.2.7, 2026.5.7, and 2026.8.2. While the SAML Source verifies the signature and validity period of assertions, it does not verify that the identity provider issued the assertion specifically for that Source or in response to a login request from that Source. Additionally, it does not track previously accepted assertions, allowing replay attacks. An unauthenticated attacker with a valid assertion can reuse or repurpose it to authenticate as the user named in the assertion. This vulnerability affects only SAML Sources and has been addressed in the fixed versions.
Potential Impact
An unauthenticated attacker who obtains a valid SAML assertion can authenticate as the user named in that assertion by reusing it or using an assertion intended for a different service provider. This can lead to unauthorized access and impersonation within the authentik system. The vulnerability does not affect other source types or SAML Providers.
Mitigation Recommendations
This vulnerability is fixed in goauthentik authentik versions 2026.2.7, 2026.5.7, and 2026.8.2. Users should upgrade to one of these versions or later to remediate the issue. No additional mitigation is required once upgraded.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-21T21:32:23.741Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab550d3f7a7c541068cffcb
Added to database: 09/24/2026, 16:33:23 UTC
Last enriched: 09/24/2026, 16:47:49 UTC
Last updated: 09/25/2026, 01:56:00 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.