CVE-2026-41569 Details
Description
authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin that passes the check (e.g. https://portal.example.com.evil.tld/), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure. This issue has been patched in version 2026.2.3.
A vulnerability exists in the WS-Federation provider of authentik, an open-source identity provider, prior to version 2026.2.3. The issue arises because the provider validates the user-supplied wreply parameter using a raw string prefix check instead of proper URL parsing. This flaw allows an attacker to craft a login link with a wreply value from a different origin that bypasses the check, such as a URL pointing to attacker-controlled infrastructure. As a result, the victim's browser may inadvertently POST the signed WS-Federation login response to the attacker's server. The vulnerability has been patched in authentik versions 2025.12.5 and 2026.2.3.
Users can upgrade to authentik version 2026.2.3 or 2025.12.5 to address this vulnerability. Alternatively, WS-Federation providers can configure the Reply URL with a specific path to prevent the host-extension bypass without patching, though upgrading is strongly preferred.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/goauthentik/authentik/security/advisories/GHSA-995q-72cw-cfw3 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| goauthentik authentik | < 2026.2.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | New CVE Received | [email protected] |