CVE-2026-57580

creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtestvtntk2j 2026-08-18 19:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtew6glcs32e...

CVE-2026-57580

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580

In authentik versions before 2026.2.6 and 2026.5.5, an inbound SAML Source using USERNAME_LINK or EMAIL_LINK matching interprets XML comments in a NameID differently than the signed assertion. An attacker who can set their NameID can inject a comment to truncate the value to a victim's username/e...