AuthentiK SAML NameID Comment Truncation Account Takeover (CVE-2026-57580)

Vulnerability Overview Vulnerability Name: CVE-2026-57580 Vulnerability Type: Account Takeover via SAML NameID Comment Truncation Description: In SAML sources, an attacker can truncate the NameID by inserting an XML comment into a validly signed assertion, thereby matching an existing account and impersonating that user. Impact Scope Affected Versions: AuthentiK 2026.5.5 and 2026.2.6 Affected Configurations: Only SAML sources configured with non-default or user matching modes are affected, and these sources must use signed assertions. Sources using the default unique identifier matching mode are not affected. The SAML Provider role (issuing assertions to downstream applications) is not affected. Exploitation Prerequisites: The attacker must have an account on the source Identity Provider (IdP) and be able to set their own NameID. Injecting a comment into the NameID truncates the value to match an existing account, while the signed assertion remains valid. Consequently, there is no need to craft a NameID that truncates to the victim's username or email. Remediation Patch: AuthentiK 2026.5.5 and 2026.2.6 fix this issue. Workarounds: 1. Add a SAML source property mapping that rejects any assertion whose NameID or attribute values contain an XML comment. This prevents the attack without altering identity linking. 2. Alternatively, switch the affected SAML sources to the default unique identifier user matching mode, which uses the full NameID and is not exploitable. Note that this changes how external identities are matched to local accounts. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

AuthentiK SAML NameID Comment Truncation Account Takeover (CVE-2026-57580)

More from this source