SAML Assertion Replay in Authentik

Compliance Impact

The vulnerability allows replay of expired SAML assertions and acceptance of assertions intended for other service providers due to lack of validation of the Conditions element. This can lead to unauthorized access or impersonation.

Such unauthorized access risks can impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive data.

Failure to properly validate authentication assertions could result in data breaches or unauthorized data processing, potentially violating these regulations.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in authentik's SAML source response processor occurs because it does not validate the Conditions element on assertions. Specifically, it ignores the NotBefore, NotOnOrAfter, and AudienceRestriction checks.

As a result, attackers can replay expired assertions or use assertions that were intended for other service providers, potentially bypassing intended security restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to reuse expired SAML assertions or use assertions meant for different service providers, which can lead to unauthorized access.

Such unauthorized access could compromise the security of your identity provider system, potentially allowing attackers to impersonate users or gain access to protected resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-41577 vulnerability, you should upgrade authentik to version 2025.12.5 or later, or 2026.2.3 or later, where the issue has been patched.

If upgrading immediately is not possible, apply any available workarounds to reduce the risk of replay attacks and acceptance of assertions intended for other service providers.

Useful 0 Not Useful 0