CVE-2026-94612

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

• CWE-287
• CWE-345

• https://docs.goauthentik.io/releases/2026.2#fixed-in-202627
• https://docs.goauthentik.io/releases/2026.5#fixed-in-202657
• https://docs.goauthentik.io/releases/2026.8#fixed-in-202682
• https://github.com/goauthentik/authentik/commit/287ea13cdc23c378abc20a7b71c9c7919a19a89a
• https://github.com/goauthentik/authentik/commit/355d8cc3d755fbba05fc5fa90ffbcbe6469acddd
• https://github.com/goauthentik/authentik/commit/54fac864a0b3bc00551af1908f662b3bf5cc6135
• https://github.com/goauthentik/authentik/commit/984b0162711f0d1988ed33544d0a671c93e4ec76
• https://github.com/goauthentik/authentik/pull/25957
• https://github.com/goauthentik/authentik/pull/25962
• https://github.com/goauthentik/authentik/pull/25967
• https://github.com/goauthentik/authentik/pull/25972
• https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7
• https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7
• https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2
• https://github.com/goauthentik/authentik/security/advisories/GHSA-cqj8-fxxf-9pg7

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9460A weakness has been identified in Edimax EW-7438RPn 1.31. Th…8.8
• CVE-2026-94604Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-94606authentik is an open-source identity provider. Prior to 2026…8.9
• CVE-2026-94609authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-9461A security vulnerability has been detected in Edimax EW-7438…8.8
• CVE-2026-94611authentik is an open-source identity provider. Prior to 2026…8.1
• CVE-2026-94613authentik is an open-source identity provider. Prior to 2026…7.5
• CVE-2026-9462A vulnerability was detected in Edimax EW-7438RPn 1.31. Affe…8.8
• CVE-2026-94622vLLM versions through 0.29.0 contain a denial of service vul…7.5
• CVE-2026-94623vLLM through 0.29.0 contains a denial of service vulnerabili…7.5
• CVE-2026-94624vLLM through 0.29.0 contains a denial of service vulnerabili…7.5
• CVE-2026-94625vLLM through 0.29.0 contains a resource exhaustion vulnerabi…5.3