CVE-2026-57580: authentik < 2026.2.6, >= 2026.5.0, < 2026.5.5

CVE-2026-57580. EPSS 0.0059 (percentile 0.47456), scored 21-Oct-2026.

Affected technology

authentik · < 2026.2.6, >= 2026.5.0, < 2026.5.5
goauthentik

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker with an account on the source identity provider who can set the account's NameID can inject an XML comment that truncates the value used by authentik to the text before the comment while the signed assertion remains valid. Vendor/CNA’s CVSS 4.0 assessment (base score 9.4/10) rates confidentiality and integrity impact as high; availability impact as none.

Published 23-Oct-2026 06:11 UTC

CWE: CWE-436
CCR priority: 0.1 /100 (P5)
EPSS: 0.0059 · percentile 0.47481 · 2026-10-22
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-23 06:11:59.600832+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-23 06:11:01.814928+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-57580.html