CVE-2026-57580

Full vulnerability record from the local CVENow database.

Description

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

Severity

CRITICAL

CVSS score

9.4 (v4.0)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-08-18 17:16:59.667000

Last modified

2026-10-22 22:10:00.250000

View original CVE JSON

{
  "id": "CVE-2026-57580",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T17:16:59.667",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5."
    },
    {
      "lang": "es",
      "value": "authentik es un proveedor de identidad de código abierto. Antes de 2026.2.6 y 2026.5.5, una fuente SAML entrante configurada con el modo de coincidencia de usuario no predeterminado USERNAME_LINK o EMAIL_LINK interpreta un comentario XML en un NameID de manera diferente a la aserción firmada del proveedor de identidad. Un atacante con una cuenta en el proveedor de identidad de origen que puede establecer el NameID de la cuenta puede inyectar un comentario XML que trunca el valor utilizado por authentik al texto anterior al comentario mientras la aserción firmada sigue siendo válida. Un NameID manipulado puede, por lo tanto, truncarse al nombre de usuario o correo electrónico de una víctima y vincular la identidad externa del atacante a la cuenta existente de la víctima. Esto otorga una toma de control total sin la contraseña de la víctima o la clave privada del proveedor de identidad, y el enlace malicioso persiste para que los inicios de sesión posteriores tengan éxito sin el comentario. Las fuentes que utilizan el modo de coincidencia de identificador único predeterminado y el rol de proveedor SAML saliente de authentik no se ven afectadas. Este problema está solucionado en las versiones 2026.2.6 y 2026.5.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "goauthentik",
          "product": "authentik",
          "versions": [
            {
              "version": "< 2026.2.6",
              "status": "affected"
            },
            {
              "version": ">= 2026.5.0, < 2026.5.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T17:45:20.895315Z",
          "id": "CVE-2026-57580",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-436"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/goauthentik/authentik/commit/6bd00f09f1f6b5bc5212a10340418fa1b264f02c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/commit/8704a1b89d7bf46bcef0d3c434c821b937fdecc3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/pull/24057",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/pull/24062",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992",
      "source": "[email protected]"
    }
  ]
}