Authentik, an open‑source identity provider, contains a flaw that allows an attacker to bypass signature verification on SAML assertions. This issue is an Authentication Failure (CWE-287) and an Improper Assertion Validation (CWE-347). When the "Verify Assertion Signature" option is enabled while "Verify Response Signature" is disabled or the Encryption Certificate is not configured, attackers can prepend a malicious assertion before the signed one. Authentik then uses the attacker‑crafted assertion, which results in unauthorized authentication and potential elevation of privileges.

The vulnerability affects Goauthentik’s authentik product on all releases prior to version 2025.8.6, 2025.10.4, and 2025.12.4. Users running any older release (e.g., 2025.8.5 or earlier) are at risk.

The CVSS score of 8.8 and an EPSS probability below 1% indicate a high‑severity weakness with relatively low exploitation likelihood at this time. Exploitation requires the attacker to construct a SAML response that reaches the authentik instance with the insecure configuration; the vulnerability can be abused remotely through the SAML protocol. Since the issue is not listed in the CISA KEV catalog, no public exploits are documented yet.