CVE-2026-94612Published
authentik: Authentication bypass via assertion confusion in SAML sources
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-94612 · Microsoft / collected KEV context
cve-program · CVE-2026-94612
- https://github.com/goauthentik/authentik/security/advisories/GHSA-cqj8-fxxf-9pg7
- https://github.com/goauthentik/authentik/pull/25957
- https://github.com/goauthentik/authentik/pull/25962
- https://github.com/goauthentik/authentik/pull/25967
- https://github.com/goauthentik/authentik/pull/25972
- https://github.com/goauthentik/authentik/commit/287ea13cdc23c378abc20a7b71c9c7919a19a89a
- https://github.com/goauthentik/authentik/commit/355d8cc3d755fbba05fc5fa90ffbcbe6469acddd
- https://github.com/goauthentik/authentik/commit/54fac864a0b3bc00551af1908f662b3bf5cc6135
- https://github.com/goauthentik/authentik/commit/984b0162711f0d1988ed33544d0a671c93e4ec76
- https://docs.goauthentik.io/releases/2026.2#fixed-in-202627
- https://docs.goauthentik.io/releases/2026.5#fixed-in-202657
- https://docs.goauthentik.io/releases/2026.8#fixed-in-202682
- https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7
- https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7
- https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.