Technical impact
The vulnerability arises because authentik’s SAML source response processor ignores the Conditions element of SAML assertions, including NotBefore, NotOnOrAfter, and AudienceRestriction, a lack of condition validation (CWE‑345). An attacker can replay expired assertions or supply assertions intended for another service provider, allowing them to authenticate without a valid, time‑constrained token or to spoof another audience’s service provider. This flaw enables unauthorized access to resources protected by the identity provider, but it does not directly expose code execution or remote command execution.
Affected Systems
The flaw exists in the open‑source authentik identity provider, affecting the goauthentik:authentik product. Versions released before 2025.12.5 and 2026.2.3 are vulnerable; these releases were patched by adding proper validation of the Conditions element.
Risk and Exploitability
With a CVSS score of 6.9, the vulnerability carries medium severity. The EPSS score is currently unavailable, and the issue is not listed in the CISA KEV catalog. The likely attack vector is the SAML authentication endpoint, where an attacker can submit a crafted SAML assertion to gain access. Because no extra authentication or credential is required beyond the assertion, the exploitation does not require privileged access on the target system.
