CVE-2026-94612

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.7 authentik versions prior to 2026.5.7 authentik versions prior to 2026.8.2

Description An issue exists in the SAML Source where the system verifies the signature and validity period of an assertion but fails to confirm if the identity provider issued the assertion specifically for that Source or in response to a login request from it. Additionally, the SAML Source does not track previously accepted assertions, which enables replay attacks. An unauthenticated actor with a valid assertion can use one intended for a different service provider or reuse a previous assertion to authenticate as the user specified in the assertion.

Recommendations Update to version 2026.2.7. Update to version 2026.5.7. Update to version 2026.8.2.