An open‑source identity‑provider system may allow an unauthenticated actor to authenticate as any user by presenting a signed SAML assertion that is valid in terms of signature and timestamp but was not issued for the affected source or in response to a login request from that source. The flaw permits replay attacks because the system does not track previously accepted assertions. The vulnerability is an authentication bypass that could lead to unauthorized access to resources, leaking user information, and potentially broader compromise. This weakness falls under CWE‑287 and CWE‑345.

The issue is limited to the authentik SAML Source component of the goauthentik:authentik product. Versions older than 2026.2.7, 2026.5.7, and 2026.8.2 are affected; later releases incorporate the fix. SAML Providers and other source types are not impacted.

The CVSS score of 7.4 indicates high severity, and though EPSS information is not available, the flaw requires no special system access beyond possessing a valid assertion. Because the attack can be performed remotely and by an unauthenticated user, the likelihood of exploitation remains significant until patched. The vulnerability is not currently listed in the CISA KEV catalog, but the absence of mitigation does not reduce the risk of active attacks.