Interpretation Conflict in authentik - CVE-2026-57580
Published: July 17, 2026
Vulnerability identifier: #VU138382
CSH Severity: High
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-57580
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to authenticate as another user.
The vulnerability exists due to interpretation conflict in SAML NameID processing when handling a validly signed assertion containing an XML comment in the NameID. A remote attacker can insert an XML comment into a crafted NameID to authenticate as another user.
Only inbound SAML Sources configured with the non-default username or email user-matching mode are affected. Exploitation requires that the attacker has an account on the source IdP and can set their own NameID. The resulting account link persists for subsequent logins.
Affected software
authentik
How to mitigate CVE-2026-57580
Install security update from vendor's website.
authentik - addressed in versions 2026.2.6, 2026.5.5