{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25922", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T16:22:17.785Z", "datePublished": "2026-02-12T19:38:16.850Z", "dateUpdated": "2026-02-17T16:19:14.739Z"}, "containers": {"cna": {"title": "authentik has a Signature Verification Bypass via SAML Assertion Wrapping", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6"}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"version": "< 2025.8.6", "status": "affected"}, {"version": ">= 2025.10.0-rc1, < 2025.10.4", "status": "affected"}, {"version": ">= 2025.10.0-rc1, < 2025.12.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T19:38:16.850Z"}, "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue."}], "source": {"advisory": "GHSA-jh35-c4cc-wjm4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:19:07.903041Z", "id": "CVE-2026-25922", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:19:14.739Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T16:19:07.903041Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:19:11.450Z"}}], "cna": {"title": "authentik has a Signature Verification Bypass via SAML Assertion Wrapping", "source": {"advisory": "GHSA-jh35-c4cc-wjm4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"status": "affected", "version": "< 2025.8.6"}, {"status": "affected", "version": ">= 2025.10.0-rc1, < 2025.10.4"}, {"status": "affected", "version": ">= 2025.10.0-rc1, < 2025.12.4"}]}], "references": [{"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4", "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4", "name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4", "name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6", "name": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T19:38:16.850Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25922", "state": "PUBLISHED", "dateUpdated": "2026-02-17T16:19:14.739Z", "dateReserved": "2026-02-09T16:22:17.785Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-12T19:38:16.850Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "903E7E1D-C429-4016-BE4D-4336F534BB9A", "versionEndExcluding": "2025.8.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B646FA7-6B60-4018-9EA8-0C3C4F18BC21", "versionEndExcluding": "2025.10.4", "versionStartIncluding": "2025.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "A59D4BC9-5FAE-4A4F-A109-D754BD80A10C", "versionEndExcluding": "2025.12.4", "versionStartIncluding": "2025.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue."}], "id": "CVE-2026-25922", "lastModified": "2026-02-18T20:59:27.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-02-12T20:16:10.910", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.8.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2025.10.0-rc1,2025.10.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2025.10.0-rc1,2025.12.4)"}}], "product": "authentik", "vendor": "goauthentik"}], "analysis": {"en": {"generated_at": "2026-04-18T12:33:35.271144+00:00", "value": {"mitigation_remediation": ["Upgrade authentik to a fixed release, either 2025.8.6, 2025.10.4, 2025.12.4, or any later version.", "Ensure that both \"Verify Assertion Signature\" and \"Verify Response Signature\" are enabled, that an Encryption Certificate is configured, and that authentication checks protect against signature bypass (addressing CWE-287) and improper validation (addressing CWE-347).", "If an upgrade cannot be performed immediately, disable \"Verify Assertion Signature\" until the Identity Provider is updated."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Goauthentik\u2019s authentik product on all releases prior to version 2025.8.6, 2025.10.4, and 2025.12.4. Users running any older release (e.g., 2025.8.5 or earlier) are at risk.", "description_and_impact": "Authentik, an open\u2011source identity provider, contains a flaw that allows an attacker to bypass signature verification on SAML assertions. This issue is an Authentication Failure (CWE-287) and an Improper Assertion Validation (CWE-347). When the \"Verify Assertion Signature\" option is enabled while \"Verify Response Signature\" is disabled or the Encryption Certificate is not configured, attackers can prepend a malicious assertion before the signed one. Authentik then uses the attacker\u2011crafted assertion, which results in unauthorized authentication and potential elevation of privileges.", "risk_and_exploitability": "The CVSS score of 8.8 and an EPSS probability below 1% indicate a high\u2011severity weakness with relatively low exploitation likelihood at this time. Exploitation requires the attacker to construct a SAML response that reaches the authentik instance with the insecure configuration; the vulnerability can be abused remotely through the SAML protocol. Since the issue is not listed in the CISA KEV catalog, no public exploits are documented yet."}}}}, "created": "2026-02-13T21:29:30.513972+00:00", "updated": "2026-04-18T12:45:45.663610+00:00", "vendors": ["goauthentik", "goauthentik$PRODUCT$authentik"]}