CVE-2026-41569

MEDIUM

authentik Before 2026.2.3 - WS-Federation wreply Origin Bypass

Title source: manual
STIX 2.1

Description

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin that passes the check (e.g. https://portal.example.com.evil.tld/), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure. This issue has been patched in version 2026.2.3.

References (1)

Core 1
Core References

Scores

CVSS v3 6.1
EPSS 0.0018
EPSS Percentile 7.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (1)
goauthentik/authentik < 2026.2.3 (2 CPE variants)
Published Jun 02, 2026
Tracked Since Jun 03, 2026