Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-94613 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://docs.goauthentik.io/releases/2026.2#fixed-in-202627	[email protected]	Release NotesVendor
https://docs.goauthentik.io/releases/2026.5#fixed-in-202657	[email protected]	Release NotesVendor
https://docs.goauthentik.io/releases/2026.8#fixed-in-202682	[email protected]	Release NotesVendor
https://github.com/goauthentik/authentik/commit/03d19d63b8d8dd7bc3de7cf6e57c6df341a9fc86	[email protected]	Source CodeVendor
https://github.com/goauthentik/authentik/commit/4cf2f803b1c2ef38c224eead375fd057a10ee8ac	[email protected]	Source CodeVendor
https://github.com/goauthentik/authentik/commit/732adad26bb97361b6bf25ef138df5c16471ba1f	[email protected]	Source CodeVendor
https://github.com/goauthentik/authentik/commit/a029f5372295bfeb1e334855f78601681cdc9a2d	[email protected]	Source CodeVendor
https://github.com/goauthentik/authentik/pull/25959	[email protected]	Source CodeVendor
https://github.com/goauthentik/authentik/pull/25964	[email protected]	Issue TrackingVendor
https://github.com/goauthentik/authentik/pull/25969	[email protected]	Issue TrackingVendor
https://github.com/goauthentik/authentik/pull/25974	[email protected]	Issue TrackingVendor
https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7	[email protected]	Release NotesVendor
https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7	[email protected]	Release NotesVendor
https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2	[email protected]	Release NotesVendor
https://github.com/goauthentik/authentik/security/advisories/GHSA-cxwx-9x59-28qm	[email protected]	AdvisoryRemedyVendor

see all 15 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-770	Allocation of Resources Without Limits or Throttling	[email protected]

Affected Products

Product	Versions
authentik	<= 2026.8.1 (semver) <= 2026.5.6 (semver) <= 2026.2.6 (semver)
CPE cpe:2.3:a:goauthentik:authentik:::::::: Remediation Upgrade: 2026.8.2moderate effort Upgrade: 2026.5.7moderate effort Upgrade: 2026.2.7moderate effort Mitigation:low effort Block requests to "/application/saml/" and "/source/saml/" at the reverse proxy or load balancer level.

Change History

1 change record found show changes