Executive brief
authentik is an open-source identity provider used to manage user logins and access to various applications. A security flaw in its SAML authentication component allows expired login sessions to be reused or sessions intended for other services to be accepted. This could allow an attacker with an old or redirected login token to gain unauthorized access to protected systems.
Technical details
A vulnerability exists in the SAML source response processor (specifically ResponseProcessor.parse()) of authentik due to insufficient verification of SAML assertion Conditions. The implementation ignores NotBefore, NotOnOrAfter, and AudienceRestriction elements. This lack of validation enables an attacker to perform replay attacks using expired assertions or to use assertions originally intended for a different service provider (SP) to authenticate to authentik. The issue is categorized as CWE-345 (Insufficient Verification of Data Authenticity) and has been addressed in versions 2025.12.5 and 2026.2.3.
Affected products
- goauthentik authentik < 2025.12.5, < 2026.2.3
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published by maintainers
- 2026-06-02: disclosed: CVE published to NVD