CVE-2026-41577 - authentik: SAML source does not validate Conditions, timing, or audience on assertions

Back Back to CVE browser

MEDIUM

authentik: SAML source does not validate Conditions, timing, or audience on assertions

Published Jun 2, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.19%

Description

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expired assertions and acceptance of assertions intended for other service providers. This issue has been patched in versions 2025.12.5 and 2026.2.3.

Affected products

Vendor Goauthentik Product Authentik Default
n/a
- Version
  < 2025.12.5
  Status
  affected
  Constraints
  -
- Version
  < 2026.2.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Goauthentik

Authentik

n/a

Version	Status	Constraints
< 2025.12.5	affected	-
< 2026.2.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-345

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33987
Advisory
https://github.com/goauthentik/authentik/security/advisories/GHSA-4v4x-x5pr-8gp2
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33987		Advisory
https://github.com/goauthentik/authentik/security/advisories/GHSA-4v4x-x5pr-8gp2		x_refsource_CONFIRMVendor Advisory