Executive Summary

The vulnerability exists in authentik, an open-source identity provider, specifically in its WS-Federation provider before version 2026.2.3. The issue is that the provider validates the user-supplied wreply parameter using a raw string prefix check instead of proper URL parsing.

An attacker can craft a login link with a wreply value that appears to be from a trusted origin but is actually from a malicious domain (for example, https://portal.example.com.evil.tld/). Because of the flawed validation, the victim's browser will send the signed WS-Federation login response to the attacker's infrastructure.

This can lead to the attacker receiving sensitive authentication tokens or information. The vulnerability was fixed in version 2026.2.3.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to intercept authentication responses by tricking a user into clicking a specially crafted login link.

As a result, the attacker could potentially capture signed WS-Federation login responses, which may include sensitive authentication tokens or credentials.

This could lead to unauthorized access to user accounts or systems that rely on authentik for identity management.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade authentik to version 2026.2.3 or later, where the issue has been patched.

Useful 0 Not Useful 0