CVE-2026-40165: authentik SAML Auth Bypass Vulnerability

CVE-2026-40165 Overview

CVE-2026-40165 is an authentication bypass vulnerability in authentik, an open-source identity provider. The flaw resides in how authentik parses the NameID element of SAML assertions. An attacker who controls a NameID value on a federated SAML Source can inject an XML comment to truncate the parsed value. The truncated value can match another user's identifier, granting access to that account. Affected releases include versions 2025.12.4 and prior, plus 2026.2.0-rc1 through 2026.2.2. The issue is fixed in versions 2025.12.5 and 2026.2.3. The vulnerability is classified under CWE-91: XML Injection.

Critical Impact
An attacker with an account on a connected SAML Source and the ability to modify their own NameID can impersonate arbitrary authentik users, including administrators.

Affected Products

authentik versions 2025.12.4 and prior
authentik versions 2026.2.0-rc1 through 2026.2.2
authentik instances configured with a SAML Source where XML Signing is enabled

Discovery Timeline

2026-05-21 - CVE-2026-40165 published to NVD
2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-40165

Vulnerability Analysis

The vulnerability arises from inconsistent XML parsing between signature validation and attribute extraction. SAML assertions carry a <NameID> element whose text content identifies the asserting subject. authentik validates the XML signature over the full assertion, then extracts the NameID text. The extraction logic returned only a portion of the text node, dropping content following an XML comment. An attacker submits an assertion where the NameID text contains a comment inside the value the attacker controls. The signature remains valid because the comment is part of the signed payload. authentik then treats the truncated string as the authenticated identity.

This mismatch lets an attacker register a NameID like victim@example.com.attacker.tld on the upstream SAML Source. After signing, authentik reads only victim@example.com and binds the session to the victim's account.

Root Cause

The pre-patch code path called self._get_name_id() and used name_id.text as the username. Python's lxmltext attribute on an element returns only the text preceding the first child node, and XML comments count as child nodes. The fix returns both the element and a fully concatenated text value, ensuring the extracted username reflects the entire signed NameID content.

Attack Vector

Exploitation requires three preconditions: an authentik instance with a configured SAML Source, an attacker account on that upstream Source with the ability to set the NameID field (commonly username or email), and XML Signing enabled on the Source. The attacker sets a malicious NameID, completes a SAML login flow, and authentik provisions or matches a user using the truncated identifier.

python

         user has an attribute that refers to our Source for cleanup. The user is also deleted
         on logout and periodically."""
         # Create a temporary User
-        name_id = self._get_name_id()
+        name_id_el, name_id = self._get_name_id()
         expiry = mktime(
             (now() + timedelta_from_string(self._source.temporary_user_delete_after)).timetuple()
         )
         user: User = User.objects.create(
-            username=name_id.text,
+            username=name_id,
             attributes={
                 USER_ATTRIBUTE_GENERATED: True,
                 USER_ATTRIBUTE_SOURCES: [

Source: authentik commit 47dec5c. The patch replaces the use of name_id.text with a fully resolved string returned from _get_name_id(), ensuring comment-embedded text nodes are concatenated before comparison.

Detection Methods for CVE-2026-40165

Indicators of Compromise

SAML assertions containing  sequences inside the <saml:NameID> element text.
authentik audit log entries showing logins where the resolved username does not match the upstream SAML Source identifier byte-for-byte.
Newly created or re-bound authentik users associated with an existing SAML Source within a short timeframe.
Authentication events from accounts that have not previously logged in via the affected SAML Source.

Detection Strategies

Inspect raw SAML responses received by authentik for XML comments inside subject-related elements, particularly NameID, Subject, and attribute values.
Correlate authentik core.user.login events with upstream Source logs to flag mismatches between the asserting NameID and the resolved authentik username.
Alert on first-time logins for privileged accounts that originate from a SAML Source rather than the usual authentication path.

Monitoring Recommendations

Forward authentik event logs and reverse-proxy access logs to a centralized SIEM for retention and correlation.
Monitor for Source configuration changes that enable XML Signing or alter SAML attribute mappings.
Track NameID values across sessions and alert on identifiers that contain non-printable characters, comment markers, or unexpected punctuation.

How to Mitigate CVE-2026-40165

Immediate Actions Required

Upgrade authentik to version 2025.12.5 or 2026.2.3 as published in the authentik 2025.12.5 release.
Review authentik audit logs for SAML logins containing comment markers in the NameID value since the SAML Source was enabled.
Rotate sessions and force re-authentication for all users provisioned through affected SAML Sources.
Audit administrator and high-privilege accounts for unauthorized access or configuration changes.

Patch Information

The fix is described in GitHub Security Advisory GHSA-9wj8-xv4r-qwrp and implemented in commit 47dec5c6b7fb4a62bfad2ae8bddf002bde7ba774. The patched releases are 2025.12.5 and 2026.2.3. The change updates authentik/sources/saml/processors/response.py so that NameID extraction returns the concatenated text of the element rather than only the text preceding the first child node.

Workarounds

Disable any SAML Source where end users can self-modify their NameID value until the upgrade is applied.
Restrict upstream SAML Source accounts so the NameID-mapped field (typically username or email) cannot be edited by end users.
Temporarily disable XML Signing on the SAML Source if the upstream Source enforces strict NameID validation, accepting the corresponding trust trade-offs.

bash

# Upgrade authentik via Docker Compose
cd /opt/authentik
sed -i 's/AUTHENTIK_TAG=.*/AUTHENTIK_TAG=2025.12.5/' .env
docker compose pull
docker compose up -d

# Verify running version
docker compose exec server ak version