CVE-2026-41577: authentik: SAML source does not validate Conditions, timing, or audience on assertions
authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expired assertions and acceptance of assertions intended for other service providers. This issue has been patched in versions 2025.12.5 and 2026.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
authentik (SAML source ResponseProcessor.parse())to a version that resolves this vulnerability.Fixed in 2025.12.5 - Upgrade
Upgrade
authentik (SAML source ResponseProcessor.parse())to a version that resolves this vulnerability.Fixed in 2026.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41577?
The severity of CVE-2026-41577 is classified as medium with a CVSS score of 6.9.
How do I fix CVE-2026-41577?
To fix CVE-2026-41577, upgrade to Authentik versions 2025.12.5 or 2026.2.3 or later.
What are the main risks associated with CVE-2026-41577?
The main risks include the potential for attackers to replay expired SAML assertions due to the lack of validation on Conditions elements.
Which software versions are affected by CVE-2026-41577?
CVE-2026-41577 affects versions of Authentik prior to 2025.12.5 and 2026.2.3.
What functionalities are compromised by CVE-2026-41577?
CVE-2026-41577 compromises the validation of NotBefore, NotOnOrAfter, and AudienceRestriction elements in SAML assertions.