Is CVE-2026-94612 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94612 being exploited in the wild.

How severe is CVE-2026-94612?

High severity, with a CVSS score of 7.4, published 24 September 2026.

Which products and versions are affected?

Authentik before 2026.2.7, 2026.5.7, and 2026.8.2.

Is there a fix for CVE-2026-94612?

A patch was published on 2026-09-24: versions 2026.2.7, 2026.5.7, and 2026.8.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94612 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94612?

Check whether you run Authentik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94612: authentik SAML Source assertion signature validation and replay weakness

CVE-2026-94612 · Severity: high · CVSS 7.4 · Published 2026-09-24

authentik is an open-source identity provider that manages user authentication and single sign-on. The SAML Source component fails to properly validate that assertions originated from the intended identity provider or were issued in response to a specific login request, and does not prevent replay of previously-accepted assertions. An attacker possessing any valid SAML assertion can reuse it to log in as the named user, or use an assertion intended for a different application.

Technologies: Authentik. Vendors: Authentik.

Quick answers

Is CVE-2026-94612 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94612 being exploited in the wild.
How severe is CVE-2026-94612?: High severity, with a CVSS score of 7.4, published 24 September 2026.
Which products and versions are affected?: Authentik before 2026.2.7, 2026.5.7, and 2026.8.2.
Is there a fix for CVE-2026-94612?: A patch was published on 2026-09-24: versions 2026.2.7, 2026.5.7, and 2026.8.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94612 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94612?: Check whether you run Authentik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SAML Source verifies assertion signatures and validity periods but omits issuer and intended recipient validation, and lacks replay detection through assertion tracking. An unauthenticated attacker with access to a valid SAML assertion from any identity provider can replay it or repurpose it against any SAML Source. The vulnerability affects SAML Sources only; SAML Providers and other Source types are not affected.

Affected products

authentik authentik before 2026.2.7, 2026.5.7, and 2026.8.2

Timeline

2026-09-24: disclosed
2026-09-24: patched: versions 2026.2.7, 2026.5.7, and 2026.8.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.