PT-2026-7894 · Authentik · Authentik

Odgrso · Published 2026-02-12 · Updated 2026-04-16 · CVE-2026-25922

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.8.6 authentik versions prior to 2025.10.4 authentik versions prior to 2025.12.4

Description authentik is an open-source identity provider. When using a SAML Source with the 'Verify Assertion Signature' option enabled under 'Verification Certificate' and 'Verify Response Signature' disabled, or without a configured 'Encryption Certificate' under 'Advanced Protocol settings', an attacker could inject a malicious assertion before the signed assertion that authentik would use. This could allow for unauthorized access or manipulation of data.

Recommendations Update authentik to version 2025.8.6. Update authentik to version 2025.10.4. Update authentik to version 2025.12.4.

Exploit

Fix

Improper Verification of Cryptographic Signature

Improper Authentication

Weakness Enumeration

CWE-347

CWE-287

Related Identifiers

BIT-AUTHENTIK-2026-25922

CVE-2026-25922

GHSA-JH35-C4CC-WJM4

Affected Products

Authentik

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25922.json · Exploit
• https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25922 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25922 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-authentik-2026-25922 · Vendor Advisory
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6 · Note
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4 · Note
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4 · Note
• https://reddit.com/r/selfhosted/comments/1r3o9od/authentik_current_release_patches_cves · Reddit Post
• https://twitter.com/CveFindCom/status/2022071018643190098 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2022120488915407319 · Twitter Post
• https://twitter.com/CVEnew/status/2022037593269883294 · Twitter Post
• https://t.me/cveNotify/152430 · Telegram Post