Skip to content
Heist/ feed
High

authentik: Denial of Service via Document Type Declarations in SAML Messages

Type: advisorySource: Official CVE ListRisk context updated1 source record

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

Announced Source revision 2
Original source ↗
CVE context updated. The publisher announcement is unchanged.

CVE-2026-94613

Primary source · Revision 2

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-94613

authentik

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "goauthentik",
    "product": "authentik",
    "versions": [
      {
        "status": "affected",
        "version": "< 2026.2.7"
      },
      {
        "status": "affected",
        "version": ">= 2026.5.0, < 2026.5.7"
      },
      {
        "status": "affected",
        "version": ">= 2026.8.0, < 2026.8.2"
      }
    ]
  }
]
Related CVEs
CVE-2026-94613

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-94613 · High

authentik

Event
#59596 · Revision 2
Added to Heist Feed
Publisher date
Read the original announcement