Which versions of authentik are affected by CVE-2026-57580?

Account takeover vulnerability in authentik identity provider (CVE-2026-57580) allows authenticated attackers to hijack victim accounts through SAML comment injection attacks.. A patch is available.

How to fix or mitigate CVE-2026-57580?

Within 24 hours: Inventory all authentik deployments and identify which use SAML authentication for user provisioning or login. Within 7 days: restrict SAML authentication to explicitly trusted upstream identity providers, enable comprehensive audit logging for SAML assertion processing and account modifications, and review recent account activity for suspicious patterns. Within 30 days: deploy vendor patches (versions 2026.2.6 for the 2026.2.x branch and 2026.5.5 for the 2026.5.x branch or later) when available, and conduct forensic audit of all accounts established or modified through SAML during the vulnerable period.

authentik CVE-2026-57580

Q: What is the CVSS score of CVE-2026-57580?

CVE-2026-57580 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-61062 CRITICAL

Interpretation Conflict (CWE-436)

2026-08-18 GitHub_M

Denial Of Service Authentik

9.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network-reachable SSO with no privileges on authentik and no victim interaction (AV:N/PR:N/UI:N); crossing from a foreign IdP account into the victim's authentik account is a scope change (S:C) with high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 18, 2026 - 18:03 EUVD

Source Code Evidence Fetched

Aug 18, 2026 - 17:43 vuln.today

Analysis Generated

Aug 18, 2026 - 17:43 vuln.today

CVE Published

Aug 18, 2026 - 17:00 cve.org

CRITICAL 9.4

DescriptionCVE.org

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

AnalysisAI

Account takeover in authentik (goauthentik) identity provider before 2026.2.6 and 2026.5.5 allows an attacker holding an account on an upstream SAML identity provider to hijack a victim's authentik account. By injecting an XML comment into the SAML NameID (e.g. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The affected authentik instance must have an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode - the default unique-identifier matching mode is not exploitable, and outbound SAML Provider usage is not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mostly aligned toward high priority: the CVSS 4.0 base score is 9.4 with network vector, no UI, and no privileges on the target (AV:N/PR:N/UI:N), high confidentiality and integrity impact, and a scope/subsequent-system impact reflecting full account takeover of a federated identity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to authentik 2026.2.6 or 2026.5.5 (release tags https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6 and https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5), which change SAML value parsing to read full element text via itertext() (commits 6bd00f09f1f6b5bc5212a10340418fa1b264f02c and 8704a1b89d7bf46bcef0d3c434c821b937fdecc3). … Detailed patch versions, workarounds, and compensating controls in full report.