CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...

EEF-CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

Summary XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is...

CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...

CVE-2026-66293

The Saxy library (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because the Saxy.Encoder fails to neutralize the -- sequence within XML comments. Specifically, the escape_comment/2 function fails to escape interior -- or full --> sequences, allowing an attacker to prematurely cl...

CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...

BIT-AUTHENTIK-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

PT-2026-79842

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME LINK or EMAIL LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

EUVD-2026-61062

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580

In authentik versions before 2026.2.6 and 2026.5.5, an inbound SAML Source using USERNAME_LINK or EMAIL_LINK matching interprets XML comments in a NameID differently than the signed assertion. An attacker who can set their NameID can inject a comment to truncate the value to a victim's username/e...

CVE-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-40165

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an...

CVE-2026-40165: Improper Authentication

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an...

CVE-2026-40165

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an...

CVE-2026-40165 authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an...

CVE-2026-44664

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace/--/g, '- -'. This skip the values containing three consecutive dashes e.g., ---..., allowing an attacker to break out of an XML comment and...

CVE-2026-44664

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace/--/g, '- -'. This skip the values containing three consecutive dashes e.g., ---..., allowing an attacker to break out of an XML comment and...

CVE-2026-44664: XML Injection (aka Blind XPath Injection)

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace/--/g, '- -'. This skip the values containing three consecutive dashes e.g., ---..., allowing an attacker to break out of an XML comment and...