authentik EUVD-2026-61062

The affected authentik instance must have an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode - the default unique-identifier matching mode is not exploitable, and outbound SAML Provider usage is not affected. The attacker must possess a valid account on the upstream (source) identity provider that authentik trusts, AND must be able to control/set that account's NameID (or a mapped attribute such as email) so it can carry an injected XML comment of the form victim<!--x-->suffix. No authentication to authentik itself and no user interaction from the victim is required (PR:N/UI:N), and the attacker does not need the victim's password or the IdP's signing private key. Limiting factors: exploitation is gated on the non-default matching configuration, on the attacker having an IdP account with attacker-controlled NameID, and on the specific comment-excluding signature canonicalization behavior.

Signals are mostly aligned toward high priority: the CVSS 4.0 base score is 9.4 with network vector, no UI, and no privileges on the target (AV:N/PR:N/UI:N), high confidentiality and integrity impact, and a scope/subsequent-system impact reflecting full account takeover of a federated identity. The one moderating factor is AT:P (attack requirement) plus the explicit precondition that the SAML Source must be configured in the non-default USERNAME_LINK or EMAIL_LINK matching mode - deployments using the default unique-identifier matching are not affected, and authentik's outbound SAML Provider role is not affected, which meaningfully narrows the exploitable population. There is no CISA KEV listing and no EPSS score supplied, and no public exploit was identified, so this is not confirmed as actively exploited; however, the mechanism is simple and fully documented in the public patch and tests, lowering the barrier to weaponization. The provided 'Denial Of Service' tag is inconsistent with the actual impact (identity takeover) and appears to be a mislabel - the description and patch clearly describe authentication bypass/account hijack, not availability loss. Given that this is an identity provider guarding downstream single sign-on, any operator running the affected matching modes should treat it as urgent and patch immediately, while operators on default matching can prioritize slightly lower after verifying their configuration.

An attacker registers or controls a normal account on an upstream SAML identity provider that an authentik instance trusts as an inbound Source configured in USERNAME_LINK mode. The attacker sets their account's NameID to 'victim_username<!--x-->random', logs into authentik via SAML, and the signed assertion validates while authentik matches on the truncated 'victim_username', binding the attacker's external identity to the victim's authentik account and granting full takeover. No public proof-of-concept was identified, but the vendor's regression tests demonstrate the exact truncation behavior.