CVE-2026-57580

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57580", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T18:49:56.208Z", "datePublished": "2026-08-18T17:00:19.209Z", "dateUpdated": "2026-11-03T22:13:28.742Z"}, "containers": {"cna": {"title": "authentik: Account Takeover via SAML NameID Comment Truncation", "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "lang": "en", "description": "CWE-436: Interpretation Conflict", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992"}, {"name": "https://github.com/goauthentik/authentik/pull/24057", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/pull/24057"}, {"name": "https://github.com/goauthentik/authentik/pull/24062", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/pull/24062"}, {"name": "https://github.com/goauthentik/authentik/commit/6bd00f09f1f6b5bc5212a10340418fa1b264f02c", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/6bd00f09f1f6b5bc5212a10340418fa1b264f02c"}, {"name": "https://github.com/goauthentik/authentik/commit/8704a1b89d7bf46bcef0d3c434c821b937fdecc3", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/8704a1b89d7bf46bcef0d3c434c821b937fdecc3"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5"}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"version": "< 2026.2.6", "status": "affected"}, {"version": ">= 2026.5.0, < 2026.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T17:00:19.209Z"}, "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5."}], "source": {"advisory": "GHSA-35v6-hv2g-6992", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57580", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T17:45:20.895315Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:13:28.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57580", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T17:45:20.895315Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T17:39:58.012Z"}}], "cna": {"title": "authentik: Account Takeover via SAML NameID Comment Truncation", "source": {"advisory": "GHSA-35v6-hv2g-6992", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"status": "affected", "version": "< 2026.2.6"}, {"status": "affected", "version": ">= 2026.5.0, < 2026.5.5"}]}], "references": [{"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992", "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/goauthentik/authentik/pull/24057", "name": "https://github.com/goauthentik/authentik/pull/24057", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/pull/24062", "name": "https://github.com/goauthentik/authentik/pull/24062", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/commit/6bd00f09f1f6b5bc5212a10340418fa1b264f02c", "name": "https://github.com/goauthentik/authentik/commit/6bd00f09f1f6b5bc5212a10340418fa1b264f02c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/commit/8704a1b89d7bf46bcef0d3c434c821b937fdecc3", "name": "https://github.com/goauthentik/authentik/commit/8704a1b89d7bf46bcef0d3c434c821b937fdecc3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6", "name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5", "name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-436", "description": "CWE-436: Interpretation Conflict"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T17:00:19.209Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57580", "state": "PUBLISHED", "dateUpdated": "2026-11-03T22:13:28.742Z", "dateReserved": "2026-06-24T18:49:56.208Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T17:00:19.209Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "authentik", "vendor": "goauthentik", "versions": [{"status": "affected", "version": "< 2026.2.6"}, {"status": "affected", "version": ">= 2026.5.0, < 2026.5.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. A crafted NameID can therefore truncate to a victim's username or email and bind the attacker's external identity to the victim's existing account. This grants full takeover without the victim's password or the identity provider's private key, and the malicious link persists so later logins succeed without the comment. Sources using the default unique-identifier matching mode and authentik's outbound SAML Provider role are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5."}, {"lang": "es", "value": "authentik es un proveedor de identidad de c\u00f3digo abierto. Antes de 2026.2.6 y 2026.5.5, una fuente SAML entrante configurada con el modo de coincidencia de usuario no predeterminado USERNAME_LINK o EMAIL_LINK interpreta un comentario XML en un NameID de manera diferente a la aserci\u00f3n firmada del proveedor de identidad. Un atacante con una cuenta en el proveedor de identidad de origen que puede establecer el NameID de la cuenta puede inyectar un comentario XML que trunca el valor utilizado por authentik al texto anterior al comentario mientras la aserci\u00f3n firmada sigue siendo v\u00e1lida. Un NameID manipulado puede, por lo tanto, truncarse al nombre de usuario o correo electr\u00f3nico de una v\u00edctima y vincular la identidad externa del atacante a la cuenta existente de la v\u00edctima. Esto otorga una toma de control total sin la contrase\u00f1a de la v\u00edctima o la clave privada del proveedor de identidad, y el enlace malicioso persiste para que los inicios de sesi\u00f3n posteriores tengan \u00e9xito sin el comentario. Las fuentes que utilizan el modo de coincidencia de identificador \u00fanico predeterminado y el rol de proveedor SAML saliente de authentik no se ven afectadas. Este problema est\u00e1 solucionado en las versiones 2026.2.6 y 2026.5.5."}], "id": "CVE-2026-57580", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57580", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T17:45:20.895315Z", "version": "2.0.3"}}]}, "published": "2026-08-18T17:16:59.667", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/commit/6bd00f09f1f6b5bc5212a10340418fa1b264f02c"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/commit/8704a1b89d7bf46bcef0d3c434c821b937fdecc3"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/pull/24057"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/pull/24062"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2026.5.0,2026.5.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "authentik", "source": "cna", "vendor": "goauthentik"}, "product": "authentik", "vendor": "goauthentik"}], "created": "2026-08-18T19:00:10.934728+00:00", "updated": "2026-08-18T19:00:12.168992+00:00", "vendors": ["goauthentik", "goauthentik$PRODUCT$authentik"]}