CVE-2026-47201: authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

Synopsis

XML Signature Wrapping (XSW) is an authentication bypass vulnerability in authentik, an open-source identity provider. The flaw is reachable over the network and requires a low-privilege account at an upstream identity provider; no victim interaction is needed. A successful attacker reuses a legitimately signed SAML assertion to authenticate as any other federated user, gaining full access under that user's identity. Fix versions 2025.12.5, 2026.2.3, and 2026.5.1 have been published, and a patched-image rebuild is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the authentik SAML ACS endpoint over the network to submit a crafted SAML response.

• AuthenticationRequired

  The attacker must hold any valid account at the upstream identity provider; a low-privilege account is sufficient.

• Victim interactionNot required

  No victim action is needed; the attacker submits the forged assertion directly to the ACS endpoint.

• Attack complexityDetail

  Exploitation is rated AC:H, meaning the attacker must carefully craft the XML structure to wrap a legitimate signed assertion around a malicious one, requiring non-trivial knowledge of the target's SAML configuration.

Blast Radius

• Reads all data accessible to the impersonated federated user, including session tokens, profile attributes, and any resources governed by authentik's authorization policies.
• Modifies account data or application state on behalf of the impersonated user, including group memberships and application-level records if the downstream application trusts authentik-issued sessions.
• Disrupts the impersonated user's active sessions by taking over their identity and locking them out or altering their credentials.
• The scope is marked Changed (S:C), meaning impact extends beyond authentik itself to downstream applications and services that rely on it for authentication.