CVE-2026-25922
📋 TL;DR
This vulnerability in authentik allows attackers to bypass SAML authentication by injecting malicious assertions before legitimate signed ones. It affects authentik instances with specific SAML Source configurations where signature verification is incomplete. Systems using affected versions are vulnerable to authentication bypass.
💻 Affected Systems
- authentik
📦 What is this software?
Authentik by Goauthentik
Authentik by Goauthentik
Authentik by Goauthentik
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected resources, potentially leading to data breaches or privilege escalation.
Likely Case
Authentication bypass enabling unauthorized access to applications relying on authentik for SAML authentication.
If Mitigated
No impact if proper signature verification is enforced or patches are applied.
🎯 Exploit Status
Requires understanding of SAML protocol and ability to intercept/modify SAML assertions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.8.6, 2025.10.4, or 2025.12.4
Vendor Advisory: https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4
Restart Required: Yes
Instructions:
1. Backup your authentik configuration and database. 2. Update authentik to version 2025.8.6, 2025.10.4, or 2025.12.4 using your deployment method (Docker, Kubernetes, etc.). 3. Restart authentik services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Enable full SAML signature verification
allConfigure SAML Sources to verify both assertion and response signatures, and ensure Encryption Certificate is properly configured.
🧯 If You Can't Patch
- Configure SAML Sources to verify both assertion and response signatures
- Ensure Encryption Certificate is properly configured in Advanced Protocol settings
🔍 How to Verify
Check if Vulnerable:
Check authentik version and SAML Source configuration. If version is below 2025.8.6/2025.10.4/2025.12.4 and SAML Sources have incomplete signature verification, system is vulnerable.Check Version:
Check authentik admin interface or run: docker exec authentik authentik version (if using Docker)Verify Fix Applied:
Verify authentik version is 2025.8.6, 2025.10.4, or 2025.12.4 or higher, and test SAML authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple SAML assertions in single response
- Unexpected authentication successes
- SAML signature validation errors
Network Indicators:
- Unusual SAML response patterns
- Multiple assertion elements in SAML responses
SIEM Query:
source="authentik" AND ("SAML" OR "assertion") AND ("error" OR "validation" OR "multiple")🔗 References
- https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4
- https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4
- https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6
- https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4
