authentik CVE-2026-41569

Exploitation requires that the target authentik instance has the WS-Federation provider explicitly configured and enabled - this is not a default or universally deployed feature; deployments using only OIDC, OAuth2, or SAML providers are not affected. The attacker must craft a login URL with a malicious wreply value and deliver it to a victim who then completes authentication through that link, making social engineering or the ability to place links in a trusted surface a practical prerequisite. The CVSS PR:N and UI:N values indicate no authentication or server-side user interaction is required from the attacker's perspective, but victim-side interaction (clicking the link and logging in) is needed to complete the assertion exfiltration. Exploitation is further bounded by version: authentik 2026.2.3 and later are not affected.

The CVSS 4.0 score of 6.9 reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack path with no stated prerequisites (AT:N, UI:N). However, the UI:N classification warrants scrutiny: the described attack requires a victim to follow a crafted login link and complete authentication, implying social engineering is a de facto prerequisite that the CVSS vector may underweight. EPSS data was not available in the provided intelligence, so exploitation probability cannot be quantified. No KEV listing and no public exploit code identified at time of analysis, which lowers urgency relative to other network-exploitable flaws. Despite the moderate CVSS score, the real-world impact is more severe than a generic redirect - the attacker captures a cryptographically signed WS-Federation assertion that could be replayed against trusting services. Risk is scoped to deployments actively using the WS-Federation provider; other authentik federation modes (OIDC, SAML) are unaffected.

An attacker crafts an authentik WS-Federation login URL with a wreply parameter set to https://portal.example.com.evil.tld/ - a domain under attacker control that passes the prefix check because it begins with the trusted string https://portal.example.com. The attacker delivers this link to a target user via phishing or an embedded URL in a trusted context. When the victim authenticates, authentik POSTs the signed WS-Federation assertion containing identity claims to the attacker's server, where it is captured and potentially replayed against services trusting that authentik IdP.