HIGH
authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
Published Jun 2, 2026
8.5
HIGHCVSS 3.1
EPSS 0.28%
Description
authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user. This issue has been patched in versions 2025.12.5, 2026.2.3, and 2026.5.1.
Affected products
-
- Version < 2025.12.5StatusaffectedConstraints-
- Version < 2026.2.3StatusaffectedConstraints-
- Version < 2026.5.1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Goauthentik | Authentik | n/a |
|
OR
- < 2025.12.6
- ≥ 2026.2.0 · < 2026.2.4
- ≥ 2026.5.0 · < 2026.5.1
No data.
No Red Hat product state for this CVE.
goauthentik.io
Go
Introduced 0 Fixed 0.0.0-20260528144335-a370d76d23c7
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | goauthentik.io | 0 | 0.0.0-20260528144335-a370d76d23c7 |
Remediation
No remediation recorded yet.
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34027 Advisory
- https://github.com/advisories/GHSA-c3m2-jqmq-pvp3 Advisory
- https://github.com/goauthentik/authentik/commit/a370d76d23c7de0fceed064ca322e33e6ebf0119
- https://github.com/goauthentik/authentik/security/advisories/GHSA-c3m2-jqmq-pvp3 x_refsource_CONFIRMMitigationVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-47201
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34027 | Advisory | |
| https://github.com/advisories/GHSA-c3m2-jqmq-pvp3 | Advisory | |
| https://github.com/goauthentik/authentik/commit/a370d76d23c7de0fceed064ca322e33e6ebf0119 | ||
| https://github.com/goauthentik/authentik/security/advisories/GHSA-c3m2-jqmq-pvp3 | x_refsource_CONFIRMMitigationVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-47201 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jun 2, 2026
Updated Jun 3, 2026
Reserved May 18, 2026
Link CVE-2026-47201
CISA Vulnrichment
Updated Jun 3, 2026
ENISA EUVD
EUVD-2026-34027 GHSA-C3M2-JQMQ-PVP3 Assigner GitHub_M
Published Jun 2, 2026
Updated Jun 3, 2026
Exploited since n/a
Link EUVD-2026-34027