authentik SAML NameID Comment Truncation Account Takeover (CVE-2026-57380)

Vulnerability Overview Vulnerability Name: Account Takeover via SAML NameID Comment Truncation CVE ID: CVE-2026-57380 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High Severity: 8.7 / 10 (High) Affected Versions Affected Versions: - <= 2026.5.4 - <= 2026.2.5 Fixed Versions: - 2026.5.5 - 2026.2.6 Impact Description: - Only affects inbound SAML sources configured with a non-default or user matching mode and using signed assertions. - Sources using the default unique identifier matching mode are not affected, nor are SAML Provider roles (issuing assertions to downstream applications). - An attacker can leverage this vulnerability to take over any account without requiring the victim's password or the IdP's private key. The link persists, allowing subsequent logins to succeed without comments. Remediation Patch: - 2026.5.5 and 2026.2.6 have resolved this issue. Workaround: - Add SAML source attribute mapping to reject any assertions where the NameID or attribute values contain XML comments. This prevents exploitation without altering identity linking. - Alternatively, switch to the affected SAML source to use the default unique identifier user matching mode, which uses the full NameID and is not exploitable. Note that this will change how external identities map to local accounts. Additional Information For any questions or comments, please contact: security@goauthentik.io Additional Page Information Publication Date: July 15, 2026 Author: emilburzo GitHub Repository: goauthentik/authentik Related Tags: Security, Advisories, GHSA-35v6-hv2g-6992 Code Snippet No POC code or exploit code was included in the page. Summary This vulnerability allows attackers to perform account takeover via SAML NameID comment truncation, affecting specific versions of the software. It is recommended to upgrade to a fixed version or implement the workaround to prevent attacks.

Goal Reached Thanks to every supporter — we hit 100%!

authentik SAML NameID Comment Truncation Account Takeover (CVE-2026-57380)

More from this source