CVE-2026-47201: goauthentik authentik XML Signature Wrapping in SAML Source ACS

CVE-2026-47201 · Severity: high · CVSS 8.5 · Published 2026-06-02

authentik is an open-source identity provider used to manage user authentication and single sign-on. A security flaw in how it handles login requests from external providers allows an attacker with a valid account to impersonate other users. This could lead to unauthorized access to sensitive corporate data or administrative accounts, potentially resulting in a full system compromise.

Technologies: goauthentik.io (Go), Goauthentik Authentik. Vendors: Go, Goauthentik.

Quick answers

Is CVE-2026-47201 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47201 being exploited in the wild.
How severe is CVE-2026-47201?
High severity, with a CVSS score of 8.5, published 2 June 2026.
Which products and versions are affected?
goauthentik.io (Go) < 0.0.0-20260528144335-a370d76d23c7, SEMVER:introduced=0,fixed=0.0.0-20260528144335-a370d76d23c7; Goauthentik Authentik < 2025.12.6, < 2026.2.4, < 2026.5.1, <= 2025.12.5, <= 2026.2.3, <= 2026.5.0.
Is there a fix for CVE-2026-47201?
Yes. goauthentik.io (Go): upgrade to 0.0.0-20260528144335-a370d76d23c7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47201 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-47201?
Check whether you run goauthentik.io (Go) or Goauthentik Authentik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • goauthentik.io (Go): upgrade to 0.0.0-20260528144335-a370d76d23c7 or later
    go get goauthentik.io@v0.0.0-20260528144335-a370d76d23c7

Technical details

The authentik SAML Source Assertion Consumer Service (ACS) endpoint is vulnerable to XML Signature Wrapping (XSW). The root cause is a failure to ensure that the verified XML signature strictly corresponds to the specific SAML assertion being processed for identity data. An attacker with a valid account at an upstream Identity Provider (IdP) can capture a legitimate signed SAML response and modify it to include a forged assertion. By wrapping the valid signature such that it still passes verification while the application logic processes the forged assertion, the attacker can authenticate as any other federated user or local user. This vulnerability has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

Affected products

  • goauthentik authentik < 2025.12.6, < 2026.2.4, < 2026.5.1

Identifiers

  • CVE-2026-47201
  • GHSA-c3m2-jqmq-pvp3

Timeline

  • 2026-05-28: advisory: Vendor advisory published on GitHub
  • 2026-06-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.