CVE-2026-57580
Received Received - Intake

SAML NameID Comment Injection in Authentik

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-57580
EUVD
EUVD-2026-61062

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
goauthentik authentik to 2026.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57580 is a vulnerability in authentik, an open-source identity provider. It affects inbound SAML Sources using non-default USERNAME_LINK or EMAIL_LINK user-matching modes. An attacker with an account on the source identity provider can inject an XML comment into a NameID to truncate the value used by authentik for account matching. This allows the attacker to bind their external identity to an existing victim's account, enabling full account takeover without the victim's password or the identity provider's private key. The vulnerability is fixed in versions 2026.2.6 and 2026.5.5.

Detection Guidance

Detecting this vulnerability requires checking authentik versions and SAML Source configurations. Verify if your authentik instance is running versions 2026.2.5 or earlier or 2026.5.4 or earlier. Inspect SAML Source configurations for non-default USERNAME_LINK or EMAIL_LINK user-matching modes. Use commands like 'docker ps' or 'kubectl get pods' to check container versions, then 'authentik-server version' to confirm the version. Review SAML Source settings in the authentik admin interface or via API.

Impact Analysis

If you use authentik with affected SAML Sources, an attacker could gain unauthorized access to your accounts. This could lead to data breaches, unauthorized actions, or complete account takeover. The impact depends on the privileges of the compromised accounts. The vulnerability persists even after the attacker's comment is removed, allowing future logins without re-exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected authentik versions may face compliance violations, potential fines, and reputational damage due to data breaches or unauthorized access to sensitive information.

Mitigation Strategies
  • Upgrade authentik to versions 2026.2.6 or 2026.5.5 or later immediately.
  • For affected SAML Sources, switch user-matching mode to the default unique-identifier mode if possible.
  • Add SAML Source property mappings to reject assertions containing XML comments in NameID or attribute values.
  • Review and audit all SAML Source configurations and user accounts for signs of unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57580. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart