authentik, an open‑source identity provider, allowed an attacker to bypass authentication by injecting an XML comment into the SAML NameID field. The comment caused authentik to truncate the value used for user identification, enabling the attacker to obtain tokens for arbitrary user accounts. The vulnerability is a classic authentication bypass (CWE‑287) that can compromise the confidentiality of all user identities and the integrity of the authentication process.

The flaw existed in authentik versions 2025.12.4 and earlier, as well as the release candidates 2026.2.0 through 2026.2.2. It can affect any instance configured with a SAML source where the attacker has an account on that source and can alter the NameID value, such as a configured username or email address.

The CVSS base score of 8.7 indicates a high severity. While a public EPSS score is not available, the existence of a CVE advisory and the lack of a KEV listing suggest that malicious exploitation is plausible but not yet proven at scale. The attack requires the attacker to control the SAML assertion through their own SAML source account and to ensure XML signing is enabled, which is a typical configuration for SAML deployments. If these conditions are met, the vulnerability can be leveraged to gain unauthorized access to any user account on the affected authentik instance.