LiveActive security incident?Get immediate response
CVE Record

CVE-2026-57580: authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

CriticalCVSS 9.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in certain inbound SAML configurations can let an attacker take over an existing authentik account without the victim’s password or the identity provider’s signing key. The attacker must control their own NameID at the source identity provider. A successful account link persists, enabling later access.

Executive priority

Treat as an urgent identity-security issue where affected matching modes are enabled. Prioritize internet-accessible or privileged SSO environments, inventory configurations immediately, and upgrade promptly. Environments using only default unique-identifier matching or authentik solely as an outbound SAML Provider are outside the described impact.

Technical view

authentik inconsistently interprets XML comments within a signed SAML NameID when USERNAME_LINK or EMAIL_LINK matching is enabled. An attacker-controlled NameID can be truncated to a victim’s username or email, binding the attacker’s external identity to that account. Default unique-identifier matching and authentik’s outbound SAML Provider role are unaffected.

Likely exposure

Exposure requires inbound SAML Sources using non-default USERNAME_LINK or EMAIL_LINK matching and affected authentik versions: before 2026.2.6, or 2026.5.0 through 2026.5.4. Risk also depends on whether source identity-provider users can control their NameID. Default unique-identifier matching is not affected.

Exploitation context

The attack is remote, requires no victim interaction, and can produce persistent account takeover. It requires an attacker account at the configured source identity provider and control over that account’s NameID. The supplied sources do not establish active exploitation, and the CVE is not marked as KEV.

Researcher notes

This is CWE-436: interpretation conflict. The signed assertion remains valid, but authentik derives a different linking value from a commented NameID. Impact is confidentiality and integrity loss across the victim account, without stated availability impact. Public sources establish affected configurations and fixed versions but do not establish exploitation in the wild.

Mitigation direction

  • Upgrade authentik to 2026.2.6 or 2026.5.5, according to the deployed release branch.
  • Identify inbound SAML Sources using USERNAME_LINK or EMAIL_LINK matching.
  • If upgrading is delayed, assess switching affected Sources to the default unique-identifier matching mode.
  • Review the vendor advisory and release notes before applying configuration or version changes.

Validation and detection

  • Confirm every authentik deployment’s exact version and release branch.
  • Enumerate inbound SAML Sources and record each configured user-matching mode.
  • Determine whether source identity-provider users can control their NameID values.
  • After remediation, verify affected Sources no longer run vulnerable versions with risky matching modes.
  • Investigate unexpected external-identity links to sensitive accounts, recognizing that successful malicious links persist.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-436: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-57580 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.4 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.4CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N——GitHub_M

Vulnerability scoring details

Base CVSS 4.0 score

9.4Critical
CVSS 4.0 vector shape for CVE-2026-57580Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
goauthentikauthentik< 2026.2.6, >= 2026.5.0, < 2026.5.5Listed
Weakness

CWE details

CWE-436

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-436 · source CWE mapping

Interpretation Conflict

Interpretation Conflict represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs