authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00643.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
goauthentik authentik affected
Version Status Constraints
< 2026.2.7 affected —
>= 2026.5.0, < 2026.5.7 affected —
>= 2026.8.0, < 2026.8.2 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Goauthentik Subscribe
Authentik Subscribe

Project Subscriptions

Vendors Products
Goauthentik Subscribe
Authentik Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://docs.goauthentik.io/releases/2026.2#fixed-in-202627 cve-icon cve-icon
https://docs.goauthentik.io/releases/2026.5#fixed-in-202657 cve-icon cve-icon
https://docs.goauthentik.io/releases/2026.8#fixed-in-202682 cve-icon cve-icon
https://github.com/goauthentik/authentik/commit/03d19d63b8d8dd7bc3de7cf6e57c6df341a9fc86 cve-icon cve-icon
https://github.com/goauthentik/authentik/commit/4cf2f803b1c2ef38c224eead375fd057a10ee8ac cve-icon cve-icon
https://github.com/goauthentik/authentik/commit/732adad26bb97361b6bf25ef138df5c16471ba1f cve-icon cve-icon
https://github.com/goauthentik/authentik/commit/a029f5372295bfeb1e334855f78601681cdc9a2d cve-icon cve-icon
https://github.com/goauthentik/authentik/pull/25959 cve-icon cve-icon
https://github.com/goauthentik/authentik/pull/25964 cve-icon cve-icon
https://github.com/goauthentik/authentik/pull/25969 cve-icon cve-icon
https://github.com/goauthentik/authentik/pull/25974 cve-icon cve-icon
https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7 cve-icon cve-icon
https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7 cve-icon cve-icon
https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2 cve-icon cve-icon
https://github.com/goauthentik/authentik/security/advisories/GHSA-cxwx-9x59-28qm cve-icon cve-icon
History

Tue, 29 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Goauthentik
Goauthentik authentik
Vendors & Products Goauthentik
Goauthentik authentik

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
Title authentik: Denial of Service via Document Type Declarations in SAML Messages
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T02:53:23.285Z

Reserved: 2026-09-21T21:32:23.741Z

Link: CVE-2026-94613

cve-icon Vulnrichment

Updated: 2026-09-29T02:53:18.463Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T17:17:17.723

Modified: 2026-09-29T03:17:21.707

Link: CVE-2026-94613

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T03:30:08Z

Weaknesses