Improper Verification of Cryptographic Signature in authentik - CVE-2026-25922
Published: April 23, 2026
Vulnerability identifier: #VU127147
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-25922
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Authentik Security Inc
Affected software:
authentik
authentik
Detailed vulnerability description
The vulnerability allows a remote user to authenticate as any existing user.
The vulnerability exists due to improper verification of cryptographic signature in the SAML source assertion processing when handling a SAML response containing a malicious assertion before a signed assertion. A remote user can inject a malicious assertion to authenticate as any existing user.
Exploitation is possible when assertion signature verification is enabled without response signature verification, or when the encryption certificate is not configured.
How to mitigate CVE-2026-25922
Install security update from vendor's website.