VulnSocial

CVE-2026-41569Disclosure(goauthentik / authentik)

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch goauthentik authentik systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin that passes the check (e.g. https://portal.example.com.evil.tld/), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure. This issue has been patched in version 2026.2.3.

goauthentik CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-601

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • authentik

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
goauthentik
Products
authentik

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-03: 2Patch / Workaround · 2026-06-03: 1Technical Details · 2026-06-03: 206-03
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-41569 authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string p… https://www.cve.org/CVERecord?id=CVE-2026-41569 ----- Traducción: CVE-2026-41569 aut… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑41569, highlighting a validation flaw in authentik’s WS‑Federation provider’s handling of the wreply parameter before version 2026.2.3, but it does not provide exploitation evidence or patch information.

    0000035
    79 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-41569 authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string p… https://www.cve.org/CVERecord?id=CVE-2026-41569

    Post summary

    The text reports a flaw in authentik's WS‑Federation implementation and indicates that version 2026.2.3 resolves the issue.

    00000244
    57.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgoauthentikauthentik---

Explore more

Back to dashboardgoauthentik CVEsauthentik vulnerabilities