EUVD-2026-34025Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionGitHub Advisory
authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin that passes the check (e.g. https://portal.example.com.evil.tld/), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure. This issue has been patched in version 2026.2.3.
AnalysisAI
Open redirect in authentik's WS-Federation provider (all versions prior to 2026.2.3) allows an unauthenticated attacker to exfiltrate signed authentication assertions to attacker-controlled infrastructure by exploiting a prefix-only wreply URL validation check. Because the POST-based WS-Federation flow delivers a cryptographically signed identity assertion to whatever destination wreply specifies, successful exploitation leaks credential-bearing tokens rather than simply redirecting to a phishing page - elevating impact beyond a typical open redirect. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
WS-Federation is a federated identity protocol in which the identity provider (IdP) POSTs a signed security assertion to a relying party endpoint specified by the wreply parameter after user authentication. authentik's implementation validated wreply by checking whether the parameter value started with a trusted string prefix rather than parsing the URL into its structural components (scheme, host, path, port). This allows domain-confusion attacks: a wreply value of https://portal.example.com.evil.tld/ passes a prefix check anchored to https://portal.example.com because the string begins with that sequence. The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The affected product is identified by CPE cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*, covering all versions before the patched release.
RemediationAI
Upgrade authentik to version 2026.2.3 or later, which replaces the raw string prefix check with proper URL parsing for wreply validation. The vendor advisory is at https://github.com/goauthentik/authentik/security/advisories/GHSA-995q-72cw-cfw3. If an immediate upgrade is not feasible, disable the WS-Federation provider entirely in the authentik admin console and migrate affected relying parties to OIDC or SAML - this eliminates the attack surface but will break any WS-Federation-dependent integrations until they are reconfigured. Network-layer egress restrictions can limit where authentik servers POST assertions, but cannot reliably substitute for the application fix because an attacker's domain could be hosted on infrastructure that passes coarse IP allowlists.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today