CVE-2026-41577 authentik: SAML source does not validate Conditions, timing, or audience on assertions

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor ResponseProcessor.parse does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expir...

Authentik data falsification vulnerability

Authentik is an open-source identity provisioning application developed by Authentik. Versions of Authentik before 2025.12.5 and 2026.2.3 had a data manipulation vulnerability. This vulnerability stemmed from the SAML response processor not verifying the Conditions element in assertions, which...