Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M

CVE-2026-41577authentik: SAML source does not validate Conditions, timing, or audience on assertions

Medium 6.9

In plain English

A medium-severity insufficient verification of data authenticity in authentik from goauthentik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.2%top 93.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expired assertions and acceptance of assertions intended for other service providers. This issue has been patched in versions 2025.12.5 and 2026.2.3.

Affected products (as reported)

Vendor	Product	Versions
goauthentik	authentik	< 2025.12.5< 2026.2.3

Weakness: CWE-345 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/goauthentik/authentik/security/advisories/GHSA-4v4x-x5pr-8gp2 x_refsource_CONFIRM