CVE-2026-94613

Deferred Deferred - Pending Action

SAML Message Processing Denial in Authentik

Publication date: 2026-09-24

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-29

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-94613

EUVD

EUVD-2026-86122

Affected Vendors & Products

Vendor	Product	Version / Range
goauthentik	authentik	2026.2.7
goauthentik	authentik	2026.5.7
goauthentik	authentik	2026.8.2
goauthentik	authentik	to 2026.2.7 (exc)
goauthentik	authentik	to 2026.5.7 (exc)
goauthentik	authentik	to 2026.8.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-94613 is a vulnerability in authentik, an open-source identity provider. An unauthenticated attacker can send a malformed SAML message to a deployment using SAML as an identity provider or SAML source. This causes the worker processing SAML requests to terminate, leading to failed requests for legitimate users. The worker restarts automatically, but repeated attacks can sustain service disruption.

Detection Guidance

To detect this vulnerability, monitor for failed SAML requests or worker process crashes in authentik deployments using SAML. Check logs for errors related to XML parsing or SAML message handling. Use network monitoring to identify malformed SAML messages sent to /application/saml/* or /source/saml/* endpoints.

Impact Analysis

This vulnerability can cause denial-of-service for SAML-based authentication in authentik. Legitimate users may be unable to log in or access services if the worker handling SAML requests crashes repeatedly. The impact is limited to SAML deployments and does not affect other protocols. Database sessions remain intact, but service availability is compromised during attacks.

Compliance Impact

This vulnerability primarily impacts availability by causing worker process failures in SAML-based authentik deployments, leading to service disruptions for legitimate users. While it does not directly expose or leak data, prolonged disruptions could interfere with access controls and audit logging required by GDPR and HIPAA. Compliance may be affected if the service outages prevent timely access to protected data or logging of authentication events.

Mitigation Strategies

Upgrade authentik to versions 2026.2.7, 2026.5.7, or 2026.8.2 or later to apply the security patch.
Temporarily block SAML endpoints at the reverse proxy or load balancer level as a workaround until upgrade is completed.

Hi! I’m here to help you understand CVE-2026-94613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70