CVE-2026-25922

Katalog CVE

CVSS 8.8 · High EPSS 0,34%

Kerentanan Improper Authentication pada goauthentik authentik. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

Rincian

Terbit di NVD

12 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4 mitigasi · advisory vendor
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4 product · release notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4 product · release notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6 product · release notes