CVE-2026-40165

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an attacker to trick authentik into only seeing a part of the NameID value, potentially allowing an attacker to gain access to other accounts. This issue could be exploited on an authentik instance with a SAML Source, where the attacker had an account on the SAML Source and the ability to modify their NameID value (commonly username or E-mail), and XML Signing was enabled. The attacker could modify the SAML assertion given to authentik by injecting a comment within the NameID value, which effectively truncated the NameID value to the snippet before the comment, and gave the attacker access to any user account. This issue has been fixed in versions 2025.12.5 and 2026.2.3.

• CWE-91
• CWE-287
• CWE-436

• https://github.com/goauthentik/authentik/commit/47dec5c6b7fb4a62bfad2ae8bddf002bde7ba774
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.5
• https://github.com/goauthentik/authentik/security/advisories/GHSA-9wj8-xv4r-qwrp

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4016A security vulnerability has been detected in GPAC 26.03-DEV…5.3
• CVE-2026-40160PraisonAIAgents is a multi-agent teams system. Prior to 1.5.…6.5
• CVE-2026-40161Tekton Pipelines project provides k8s-style resources for de…6.5
• CVE-2026-40162Bugsink is a self-hosted error tracking tool. In 2.1.0, an a…7.1
• CVE-2026-40163Saltcorn is an extensible, open source, no-code database app…8.2
• CVE-2026-40164jq is a command-line JSON processor. Before commit 0c7d133c3…7.5
• CVE-2026-40166authentik is an open-source identity provider. In versions p…7.1
• CVE-2026-40168Postiz is an AI social media scheduling tool. Prior to 2.21.…8.2
• CVE-2026-40169ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-4017Buffer Overflow in the entry handler of the TraceEvent() sys…7.4
• CVE-2026-40170ngtcp2 is a C implementation of the IETF QUIC protocol. In v…7.5
• CVE-2026-40171In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab…8.4