CVE-2026-25922: 
NixOS vulnerability analysis and mitigation

CVE-2026-25922 is a SAML assertion injection vulnerability in authentik, an open-source identity provider, that allows a low-privileged network attacker to bypass signature verification and authenticate as any existing user. The vulnerability affects authentik versions up to and including 2025.8.5, 2025.10.3, and 2025.12.3. It was published on February 12, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper verification of cryptographic signatures (CWE-347) combined with improper authentication (CWE-287). When a SAML Source is configured with "Verify Assertion Signature" enabled but "Verify Response Signature" disabled — or when no Encryption Certificate is configured under Advanced Protocol settings — authentik fails to enforce strict ordering of SAML assertions within the response. An attacker can craft a SAML response containing a malicious, unsigned assertion placed before the legitimately signed assertion; authentik then processes the attacker-controlled assertion instead of the valid one. This attack requires only low privileges (e.g., the ability to interact with the SAML authentication flow) and no user interaction (GitHub Advisory).

Successful exploitation allows an attacker to impersonate any existing user in the authentik identity provider, effectively achieving a full authentication bypass. Because authentik acts as a central identity provider for downstream applications, this can enable broad lateral movement across all services relying on it for SSO. The impact spans high confidentiality, integrity, and availability — an attacker could access sensitive data, modify system configurations, and disrupt services for legitimate users (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.009% (0.000090), indicating a currently low probability of exploitation in the near term. However, the attack requires only low privileges and no user interaction over the network, making it relatively straightforward to exploit if the vulnerable configuration is present (GitHub Advisory).

1. Reconnaissance: Identify authentik instances exposed to the network and determine whether they use a SAML Source with "Verify Assertion Signature" enabled but "Verify Response Signature" disabled, or without an Encryption Certificate configured.
2. Obtain a legitimate SAML response: Initiate a normal SAML authentication flow to capture a valid SAML response containing a properly signed assertion from the Identity Provider.
3. Craft a malicious SAML response: Construct a modified SAML response that prepends a forged, unsigned assertion (containing attacker-chosen identity attributes, e.g., an admin username) before the legitimate signed assertion in the XML document.
4. Submit the crafted response: POST the manipulated SAML response to the authentik SAML assertion consumer service (ACS) endpoint.
5. Authentication bypass achieved: Because authentik processes the first assertion found in the response without enforcing that it must be the signed one, it authenticates the attacker as the user specified in the injected assertion, granting full access to the target account (GitHub Advisory).

• Logs: authentik authentication logs showing successful SAML logins for privileged or unexpected users from unfamiliar IP addresses or at unusual times; log entries where the authenticated user does not match the expected IdP-issued subject.
• Network: Unusual or repeated POST requests to the authentik SAML ACS endpoint (e.g., /source/saml/<slug>/acs/) containing SAML responses with oversized or malformed XML payloads.
• Application Behavior: Multiple SAML assertions present in a single SAML response (detectable via the workaround property mapping expression); unexpected session creation for high-privilege accounts without corresponding IdP-side login events.
• Audit Trail: Access to administrative functions or sensitive resources by accounts that have no corresponding IdP authentication event in the upstream Identity Provider's own logs (GitHub Advisory).

Upgrade authentik to the patched versions: 2025.8.6 (for the 2025.8.x branch), 2025.10.4 (for the 2025.10.x branch), or 2025.12.4 (for the 2025.12.x branch) (GitHub 2025.8.6 Release, GitHub 2025.10.4 Release, GitHub 2025.12.4 Release). If immediate upgrade is not possible, two configuration-based workarounds are available: (1) enable "Verify Response Signature" on the SAML Source, or configure an Encryption Certificate under Advanced Protocol settings; (2) add the following property mapping expression to the SAML Source to detect and reject responses with multiple assertions:

assertions = root.findall("{urn:oasis:names:tc:SAML:2.0:assertion}Assertion")
if len(assertions) > 1:
    raise ValueError("Multiple assertions found")
return {}

For questions, contact the authentik security team at security@goauthentik.io (GitHub Advisory).

The vulnerability was discussed in the self-hosted community on Reddit, where users noted the importance of updating authentik promptly given its role as a central identity provider (Reddit r/selfhosted). The Hacker Wire covered the disclosure and later published a related technical article on authentik authentication bypass via SAML NameID XML comment injection. Social media activity on Bluesky and Mastodon reflected moderate community awareness, consistent with the severity of the issue for self-hosted identity infrastructure.