The vulnerability allows an unauthenticated attacker to send a crafted SAML message containing a malformed Document Type Declaration. This payload causes the worker that handles /application/saml/* or /source/saml/* requests to terminate. When the worker restarts, database‑backed sessions remain, but legitimate traffic to those endpoints suffers temporary failure. Repeated malicious messages can keep a portion of legitimate traffic unusable, effectively creating a denial of service scenario. The weakness is classed as denial‑of‑service (CWE‑770).

The issue affects the open‑source identity provider authentik released by goauthentik:authentik. Any deployment using the Identity‑Provider or SAML source role before the 2026.2.7, 2026.5.7, or 2026.8.2 releases is vulnerable. The fix is included in those specific releases, and subsequent versions inherit the fix.

The CVSS score is 7.5, indicating a high impact and moderate probability of exploitation. Because the attacker does not need authentication and can trigger the flaw via standard network traffic, the risk is elevated. EPSS information is not available, but the lack of KEV listing and the high CVSS suggest a moderate to high threat posture. Attackers could interrupt SAML‑enabled services by sending repeated malformed messages, causing sustained service degradation. Mitigation through patching remains the most effective countermeasure.