PT-2026-45833

CVE-2026-41577

Published

2026-06-02

Updated

2026-06-05

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.12.5 authentik versions prior to 2026.2.3

Description The SAML source response processor ResponseProcessor.parse() fails to validate the Conditions element on assertions. Specifically, NotBefore, NotOnOrAfter, and AudienceRestriction are ignored, which enables the replay of expired assertions and the acceptance of assertions intended for different service providers.

Recommendations Update to version 2025.12.5. Update to version 2026.2.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Android-Login-Analysis

Ayushparkara

Kodareef5

Vendors

Affected products

Weakness enumeration