← Back

CVE-2026-25922

nvd nist
Published: Feb 12, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security-advisories@github.com (Secondary)

Description

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

Affected (3)

Goauthentik
1 product
Authentik
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Goauthentik
Authentik
Before 2025.8.6
Authentik
From 2025.10.0 to 2025.10.4
Authentik
From 2025.12.0 to 2025.12.4

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-347
Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (4)

Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
MitigationVendor Advisory

Timeline

No history available yet.