PT-2026-45854

CVE-2026-41569

Published

2026-06-02

Updated

2026-06-05

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.3

Description The WS-Federation provider in this open-source identity provider validates the user-supplied wreply parameter using a raw string prefix check instead of proper URL parsing. An attacker can craft a login link with a wreply value from a different origin that bypasses this check, leading the victim's browser to POST the signed WS-Federation login response to infrastructure controlled by the attacker.

Recommendations Update to version 2026.2.3.

Exploitability

Exploit

Fix

Impacts

Researchers

Ayushparkara

Jmecom

Vendors

Affected products

Weakness enumeration

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')