CVE-2026-57580

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-57580

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57580.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-57580

Aliases

BIT-authentik-2026-57580
GHSA-35v6-hv2g-6992

Published

2026-08-18T17:00:19Z

Modified

2026-09-10T03:31:01Z

Severity

9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

authentik: Account Takeover via SAML NameID Comment Truncation

Details

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-436"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57580.json"
}

References

Affected packages

Git / github.com/goauthentik/authentik

Affected ranges

Type

GIT

Repo

https://github.com/goauthentik/authentik

Events

Introduced

7a71bcfcdc442204b8985ab379b22f7eb9fe321f

Fixed

ed54cc3b30a4511c650690cbdcd7bfbc198c02b8

Fixed

8f35dc72e2b8f832dce5f385f3bf3830f7791d26

Fixed

6bd00f09f1f6b5bc5212a10340418fa1b264f02c

Fixed

8704a1b89d7bf46bcef0d3c434c821b937fdecc3

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.2.6"
        },
        {
            "introduced": "2026.5.0"
        },
        {
            "fixed": "2026.5.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

version/0.*

version/0.0.10-alpha

version/0.0.11-alpha

version/0.0.12-alpha

version/0.0.13-alpha

version/0.0.2-alpha

version/0.0.3-alpha

version/0.0.4-alpha

version/0.0.5-alpha

version/0.0.6-alpha

version/0.0.7-alpha

version/0.0.8-alpha

version/0.0.9-alpha

version/0.1.0-beta

version/0.1.1-beta

version/0.1.10-beta

version/0.1.11-beta

version/0.1.12-beta

version/0.1.13-beta

version/0.1.14-beta

version/0.1.15-beta

version/0.1.16-beta

version/0.1.17-beta

version/0.1.18-beta

version/0.1.19-beta

version/0.1.2-beta

version/0.1.20-beta

version/0.1.21-beta

version/0.1.22-beta

version/0.1.23-beta

version/0.1.24-beta

version/0.1.25-beta

version/0.1.26-beta

version/0.1.27-beta

version/0.1.28-beta

version/0.1.29-beta

version/0.1.3-beta

version/0.1.30-beta

version/0.1.31-beta

version/0.1.32-beta

version/0.1.33-beta

version/0.1.34-beta

version/0.1.35-beta

version/0.1.36-beta

version/0.1.37-beta

version/0.1.38-beta

version/0.1.4-beta

version/0.1.5-beta

version/0.1.6-beta

version/0.1.7-beta

version/0.1.8-beta

version/0.1.9-beta

version/0.10.0-rc1

version/0.10.0-rc2

version/0.10.0-rc3

version/0.10.0-rc4

version/0.10.0-rc5

version/0.10.0-rc6

version/0.10.0-stable

version/0.10.1-stable

version/0.10.2-stable

version/0.10.3-stable

version/0.10.4-stable

version/0.10.5-stable

version/0.10.6-stable

version/0.10.7-stable

version/0.10.8-stable

version/0.10.9-stable

version/0.11.0-stable

version/0.12.0-stable

version/0.12.1-stable

version/0.12.10-stable

version/0.12.11-stable

version/0.12.2-stable

version/0.12.3-stable

version/0.12.4-stable

version/0.12.5-stable

version/0.12.6-stable

version/0.12.7-stable

version/0.12.8-stable

version/0.12.9-stable

version/0.13.0-rc1

version/0.13.0-rc2

version/0.13.0-rc3

version/0.13.0-rc4

version/0.13.0-stable

version/0.13.1-stable

version/0.13.2-stable

version/0.13.3-stable

version/0.2.0-beta

version/0.2.1-beta

version/0.2.2-beta

version/0.2.3-beta

version/0.2.4-beta

version/0.2.5-beta

version/0.2.6-beta

version/0.2.7-beta

version/0.2.8-beta

version/0.3.0-beta

version/0.4.0-beta

version/0.4.1-beta

version/0.4.2-beta

version/0.5.0-beta

version/0.6.0-beta

version/0.6.1-beta

version/0.6.2-beta

version/0.6.3-beta

version/0.7.0-beta

version/0.7.1-beta

version/0.7.10-beta

version/0.7.11-beta

version/0.7.12-beta

version/0.7.13-beta

version/0.7.14-beta

version/0.7.15-beta

version/0.7.16-beta

version/0.7.17-beta

version/0.7.2-beta

version/0.7.3-beta

version/0.7.4-beta

version/0.7.5-beta

version/0.7.6-beta

version/0.7.7-beta

version/0.7.8-beta

version/0.7.9-beta

version/0.8.0-beta

version/0.8.1-beta

version/0.8.10-beta

version/0.8.11-beta

version/0.8.12-beta

version/0.8.14-beta

version/0.8.15-beta

version/0.8.2-beta

version/0.8.3-beta

version/0.8.4-beta

version/0.8.5-beta

version/0.8.6-beta

version/0.8.7-beta

version/0.8.8-beta

version/0.8.9-beta

version/0.9.0-pre1

version/0.9.0-pre2

version/0.9.0-pre3

version/0.9.0-pre4

version/0.9.0-pre5

version/0.9.0-pre6

version/0.9.0-pre7

version/0.9.0-rc1

version/0.9.0-rc2

version/0.9.0-stable

version/2021.*

version/2021.1.1-rc1

version/2021.1.1-rc2

version/2021.1.1-stable

version/2021.1.2-stable

version/2021.1.3-stable

version/2021.10.1-rc3

version/2021.10.3

version/2021.10.4

version/2021.12.1

version/2021.12.1-rc1

version/2021.12.1-rc2

version/2021.12.1-rc3

version/2021.12.1-rc4

version/2021.12.1-rc5

version/2021.12.2

version/2021.12.3

version/2021.12.4

version/2021.12.5

version/2021.2.2-stable

version/2021.2.3-stable

version/2021.3.1

version/2021.3.1-rc1

version/2021.3.1-rc2

version/2021.3.2

version/2021.3.3

version/2021.3.4

version/2021.4.1

version/2021.4.1-rc1

version/2021.4.1-rc2

version/2021.5.1

version/2021.5.1-rc10

version/2021.5.1-rc8

version/2021.5.1-rc9

version/2021.5.2

version/2021.6.1

version/2021.6.1-rc1

version/2021.6.1-rc2

version/2021.6.1-rc3

version/2021.6.1-rc4

version/2021.6.3

version/2021.6.4

version/2021.7.1

version/2021.7.1-rc1

version/2021.8.1

version/2021.8.1-rc2

version/2021.8.2

version/2021.8.3

version/2021.8.4

version/2021.9.1

version/2021.9.1-rc1

version/2021.9.1-rc2

version/2021.9.1-rc3

version/2021.9.2

version/2021.9.3

version/2022.*

version/2022.1.1

version/2022.1.3

version/2022.1.4

version/2022.10.1

version/2022.12.0

version/2022.12.1

version/2022.2.1

version/2022.3.3

version/2022.4.1

version/2022.5.1

version/2022.5.2

version/2022.6.2

version/2022.7.2

version/2022.8.1

version/2022.8.2

version/2022.9.0

version/2023.*

version/2023.10.0

version/2023.2.1

version/2023.5.1

version/2023.6.0

version/2023.8.0

version/2023.8.1

version/2023.8.2

version/2026.*

version/2026.2.0

version/2026.2.0-rc1

version/2026.2.0-rc2

version/2026.2.0-rc3

version/2026.2.0-rc4

version/2026.2.0-rc5

version/2026.2.1

version/2026.2.1-rc1

version/2026.2.2

version/2026.2.2-rc1

version/2026.2.2-rc2

version/2026.2.2-rc3

version/2026.2.3

version/2026.2.3-rc1

version/2026.2.4

version/2026.2.5

version/2026.5.0

version/2026.5.2

version/2026.5.3

version/2026.5.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57580.json"