CVE-2026-94613: authentik: Denial of Service via Document Type Declarations in SAML Messages
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/ or /source/saml/, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2026.2.7 - Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2026.5.7 - Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2026.8.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using SAML in either the identity-provider role or the SAML source role are affected if they run a version earlier than 2026.2.7, 2026.5.7, or 2026.8.2. Other protocol implementations are not affected.
Does an attacker need an account or user interaction to trigger the denial of service?
No. An unauthenticated attacker can submit a malformed SAML message to the affected SAML endpoints.
What is the operational impact of a successful attack?
The malformed message can stop the worker handling /application/saml/* or /source/saml/*, causing requests assigned to that worker to fail. Database-backed sessions are retained when the worker terminates and automatically restarts, but repeated malicious messages can sustain failures for a share of legitimate traffic.
How can this be remediated?
Upgrade to authentik 2026.2.7, 2026.5.7, or 2026.8.2, as applicable to the deployed release line.