Detection Guidance

Detection of this vulnerability involves monitoring for malicious SAML assertions injected before the legitimate signed assertion in the authentik SAML Source configuration.

One suggested method to help detect exploitation attempts is to add a property mapping expression to detect duplicate assertions, for example, using an expression like assertions = root.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-25922 is a high-severity vulnerability in the authentik open-source identity provider. It occurs when using a SAML Source configured with the "Verify Assertion Signature" option enabled but without enabling "Verify Response Signature", or when the Encryption Certificate is not set under Advanced Protocol settings.'}, {'type': 'paragraph', 'content': 'Under these conditions, an attacker can inject a malicious SAML assertion before the legitimate signed assertion. authentik would then accept and use this malicious assertion instead of the legitimate one.'}, {'type': 'paragraph', 'content': 'This flaw allows an attacker to authenticate as any existing user depending on the source configuration, due to improper authentication and improper verification of cryptographic signatures.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to user accounts by attackers who inject malicious assertions.

Because the attacker can authenticate as any existing user, this compromises confidentiality, integrity, and availability of the system.

• Confidentiality impact: attacker can access sensitive user data.
• Integrity impact: attacker can perform actions as legitimate users.
• Availability impact: attacker could disrupt services or user access.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The primary mitigation is to upgrade authentik to one of the patched versions: 2025.8.6, 2025.10.4, or 2025.12.4.'}, {'type': 'paragraph', 'content': 'If upgrading is not immediately possible, you can mitigate the vulnerability by configuring the SAML Source to enable the "Verify Response Signature" option or by setting the Encryption Certificate under Advanced Protocol settings.'}, {'type': 'paragraph', 'content': 'Additionally, adding a property mapping expression to detect duplicate assertions (e.g., assertions = root) can help reduce the risk of exploitation.'}] [1]

Useful 0 Not Useful 0