CVE-2026-25922 Overview
CVE-2026-25922 is an authentication bypass vulnerability affecting authentik, an open-source identity provider. The vulnerability allows attackers to inject a malicious SAML assertion before a legitimately signed assertion when specific SAML Source configurations are in use. When exploited, authentik processes the attacker's injected assertion instead of the legitimate signed one, potentially enabling unauthorized access to protected resources.
Critical Impact
This vulnerability enables attackers to bypass SAML authentication controls, potentially gaining unauthorized access to applications and services protected by authentik. Organizations using affected SAML configurations may be exposed to identity spoofing and unauthorized account access.
Affected Products
- authentik versions prior to 2025.8.6
- authentik versions prior to 2025.10.4
- authentik versions prior to 2025.12.4
Discovery Timeline
- February 12, 2026 - CVE-2026-25922 published to NVD
- February 12, 2026 - Last updated in NVD database
Technical Details for CVE-2026-25922
Vulnerability Analysis
This vulnerability stems from improper authentication handling (CWE-287) in authentik's SAML Source processing logic. The flaw specifically manifests when a SAML Source is configured with the "Verify Assertion Signature" option enabled under Verification Certificate, but without the "Verify Response Signature" option enabled, or when the Encryption Certificate setting under Advanced Protocol settings is not configured.
Under these specific configurations, the SAML processing logic fails to properly validate the order and integrity of assertions within a SAML response. An attacker can craft a malicious SAML response that includes an unsigned assertion positioned before the legitimately signed assertion. Due to the processing order vulnerability, authentik extracts and uses the first (malicious) assertion while ignoring the subsequent signed assertion that would normally be validated.
The network-accessible nature of this vulnerability combined with the low complexity of exploitation makes it particularly concerning for organizations relying on authentik for identity federation.
Root Cause
The root cause of CVE-2026-25922 is improper authentication validation in the SAML assertion processing pipeline. The vulnerability exists because the application does not adequately verify that the assertion being processed is the same assertion that was cryptographically signed. When response signature verification is disabled and only assertion signature verification is enabled, the application becomes susceptible to assertion injection attacks where unsigned assertions can be prepended to the SAML response.
Attack Vector
The attack vector for this vulnerability is network-based and requires the attacker to have low-privilege access to interact with the SAML authentication flow. The attack proceeds as follows:
- The attacker intercepts or crafts a SAML response destined for a vulnerable authentik instance
- The attacker prepends a malicious unsigned SAML assertion containing arbitrary identity claims before the legitimate signed assertion
- The modified SAML response is submitted to the authentik SAML endpoint
- Due to the processing order flaw, authentik extracts the first (malicious) assertion
- Since assertion signature verification checks the signed assertion but the application uses the unsigned one, the attack succeeds
- The attacker gains access as the identity specified in the injected assertion
The vulnerability exploitation does not require user interaction, allowing attackers to potentially automate attacks against vulnerable deployments. For detailed technical information, refer to the GitHub Security Advisory GHSA-jh35-c4cc-wjm4.
Detection Methods for CVE-2026-25922
Indicators of Compromise
- Unusual SAML authentication events with mismatched assertion counts or duplicate assertions in logs
- Authentication successes for users that cannot be correlated with legitimate identity provider activity
- SAML responses containing multiple assertion elements where only one was expected
- Anomalous user session creation patterns, particularly for privileged accounts
Detection Strategies
- Monitor authentik logs for SAML authentication anomalies, including responses with multiple assertions
- Implement network-level inspection for SAML traffic with unusual assertion structures
- Audit successful authentications against identity provider logs to identify sessions not initiated by legitimate sources
- Deploy SentinelOne to detect suspicious authentication patterns and identity-based threats
Monitoring Recommendations
- Enable verbose logging for SAML Source authentication events in authentik
- Configure alerting for authentication events from SAML Sources that lack encryption certificates
- Review SAML Source configurations to identify instances vulnerable to this attack vector
- Implement anomaly detection for user login patterns, particularly for administrative accounts
How to Mitigate CVE-2026-25922
Immediate Actions Required
- Upgrade authentik to version 2025.8.6, 2025.10.4, or 2025.12.4 or later immediately
- Review all SAML Source configurations and enable both "Verify Assertion Signature" and "Verify Response Signature" options
- Configure Encryption Certificates under Advanced Protocol settings for all SAML Sources
- Audit recent authentication logs for signs of exploitation prior to patching
Patch Information
The authentik development team has released security patches addressing this vulnerability across multiple release branches. Organizations should upgrade to one of the following fixed versions based on their current deployment:
For complete details on the security issue and remediation guidance, refer to the GitHub Security Advisory GHSA-jh35-c4cc-wjm4.
Workarounds
- Enable both "Verify Assertion Signature" and "Verify Response Signature" options on all SAML Sources
- Configure Encryption Certificates in Advanced Protocol settings for SAML Sources to prevent assertion manipulation
- Consider temporarily disabling vulnerable SAML Sources until patches can be applied
- Implement additional network-level controls to restrict access to SAML authentication endpoints
# Configuration example
# Review and update SAML Source settings in authentik admin interface:
# 1. Navigate to Directory -> Federation & Social Login -> Sources
# 2. Edit each SAML Source
# 3. Under "Verification Certificate" section, enable "Verify Response Signature"
# 4. Under "Advanced Protocol settings", configure "Encryption Certificate"
# 5. Save changes and test SAML authentication flow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
