CVE-2026-41569: authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin that passes the check (e.g. https://portal.example.com.evil.tld/), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure. This issue has been patched in version 2026.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
authentik (WS-Federation provider)to a version that resolves this vulnerability.Fixed in 2026.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41569?
CVE-2026-41569 has a medium severity score of 6.9 according to the CVSS v4.0.
How do I fix CVE-2026-41569?
To fix CVE-2026-41569, upgrade to version 2026.2.3 or later of the Authentik software.
What systems are affected by CVE-2026-41569?
CVE-2026-41569 affects the Authentik identity provider prior to version 2026.2.3.
What type of vulnerability is CVE-2026-41569?
CVE-2026-41569 is a vulnerability that allows WS-Federation wreply origin bypass, which can lead to information exfiltration.
What could an attacker do with CVE-2026-41569?
An attacker can exploit CVE-2026-41569 to exfiltrate signed login responses to their own endpoints by crafting a malicious login link.