https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:13:01 +0000 https://vulnerability.circl.lu/vuln/bit-authentik-2026-57580 <p><strong>Affected:</strong> Bitnami: authentik</p> <p>authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider&#39;s signed assertion. An attacker with an account on the source identity provider who can set the account&#39;s NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim&#39;s username or email and bind the attacker&#39;s external identity to the victim&#39;s existing account. This grants full takeover without the victim&#39;s password or the identity provider&#39;s private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik&#39;s outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.</p> <p><strong>Affected:</strong> Bitnami: authentik</p> <p>authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider&#39;s signed assertion. An attacker with an account on the source identity provider who can set the account&#39;s NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim&#39;s username or email and bind the attacker&#39;s external identity to the victim&#39;s existing account. This grants full takeover without the victim&#39;s password or the identity provider&#39;s private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik&#39;s outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.</p> https://vulnerability.circl.lu/vuln/bit-authentik-2026-57580 https://vulnerability.circl.lu/vuln/fkie_cve-2026-57580 <p>authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider&#39;s signed assertion. An attacker with an account on the source identity provider who can set the account&#39;s NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim&#39;s username or email and bind the attacker&#39;s external identity to the victim&#39;s existing account. This grants full takeover without the victim&#39;s password or the identity provider&#39;s private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik&#39;s outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.</p> <p>authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider&#39;s signed assertion. An attacker with an account on the source identity provider who can set the account&#39;s NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim&#39;s username or email and bind the attacker&#39;s external identity to the victim&#39;s existing account. This grants full takeover without the victim&#39;s password or the identity provider&#39;s private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik&#39;s outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-57580