The vulnerability allows an attacker to forge a SAML assertion that contains an XML comment in the NameID. Because authentik parses the comment differently than the identity provider does, the comment truncates the NameID value to the text before the comment. This enables the attacker to bind an external identity to a victim's existing account, effectively taking over that account without needing the victim’s password or the identity provider’s private key. The weakness is classified as CWE‑436, a defect in the handling of XML comments.

Affected products are the authentik identity provider from goauthentik. All instances running versions before 2026.2.6 or 2026.5.5 that use an inbound SAML source with the USERNAME_LINK or EMAIL_LINK user‑matching modes are vulnerable. Inbound sources configured with the default unique‑identifier matching mode or the authentik outbound SAML provider are not impacted.

The CVSS base score of 9.4 marks this as a critical flaw. EPSS data is not available, so the likelihood of exploitation cannot be quantified, but the attack requires an attacker‑controlled identity provider and a victim whose account is linked via the vulnerable matching mode. Because the flaw leads to full account takeover and is exploitable from any network location that can deliver the crafted assertion, the risk is high. The flaw is currently not listed in the CISA KEV catalog, but that does not mitigate the need for a prompt patch.