Open-Source Identity Provider Vulnerability in Authentik by GoAuthentik

CVE-2026-41569

What is CVE-2026-41569?

Authentik, an open-source identity provider, has a vulnerability related to its WS-Federation provider that improperly validates the user-supplied wreply parameter. Instead of employing a comprehensive URL parsing method, it uses a simplistic raw string prefix check. This design flaw allows an attacker to craft a malicious login link that provides a wreply value sourced from a different origin, potentially redirecting the response to an attacker-controlled endpoint. This security issue has been addressed in version 2026.2.3, urging users to update to protect against exploitation.

References