authentik Authentication Bypass: SAML NameID XML Comment Injection (CVE-2026-40165)

The National Vulnerability Database has disclosed CVE-2026-40165, a critical authentication bypass vulnerability impacting authentik, an open-source identity provider. This flaw, present in versions 2025.12.4 and prior, and 2026.2.0-rc1 through 2026.2.2, stems from how authentik processes SAML NameID values. An attacker can inject an XML comment within the NameID, effectively truncating the value and tricking authentik into accepting a partial NameID. This can grant unauthorized access to other user accounts.

Exploitation requires specific conditions: a SAML Source configured in authentik, an attacker with an account on that SAML Source, the ability to modify their NameID (typically username or email), and XML Signing enabled. The attacker manipulates the SAML assertion, inserting a comment that cuts off the NameID, allowing them to impersonate any user. The National Vulnerability Database assigns this a CVSS score of 8.7 (HIGH), underscoring the severity of this bypass.

This is a significant issue for organizations relying on authentik for identity management. The vulnerability fundamentally undermines the trust established by SAML assertions. Defenders must understand that this isn’t a theoretical attack; it’s a direct manipulation of a core authentication mechanism. The fix is available in versions 2025.12.5 and 2026.2.3. Patching is not optional here; it’s an immediate security imperative.