CVE-2026-41569: authentik WS-Federation URL Validation Bypass Leading to Credential Theft

Technical summary

The WS-Federation provider in authentik performs URL validation on the wreply parameter using a simple string prefix check rather than proper URL parsing and comparison. This allows an attacker to supply a wreply value on a different origin that passes the validation (e.g., by prepending the legitimate domain as a substring within a malicious URL). When a victim authenticates, their browser receives a POST request containing a signed WS-Federation token, which is then directed to the attacker's infrastructure instead of the intended destination. This is a classic open redirect vulnerability at the authentication layer, enabling credential theft and session hijacking. The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site).

Business impact

This vulnerability exposes organizations using authentik to credential harvesting and session compromise. An attacker can obtain signed authentication tokens for any user who clicks a crafted login link, potentially gaining unauthorized access to downstream applications that trust the authentik token. This is particularly critical in environments where authentik serves as a centralized identity provider for multiple internal or customer-facing applications. The compromise of authentication credentials undermines the security posture of the entire identity ecosystem relying on that authentik instance.

Affected systems

The vulnerability affects authentik versions prior to 2026.2.3. Organizations running earlier versions of authentik, particularly those exposing the WS-Federation provider to untrusted users or the public internet, are at risk. The vulnerability applies to any deployment model—on-premises, cloud-hosted, or containerized—as long as the version is unpatched.

Exploitability

The vulnerability requires user interaction: a victim must click a malicious login link supplied by the attacker. However, the attack surface is broad because the attacker can send this link via email, messaging, or social engineering. No special privileges are required to craft the malicious URL, and the exploit is straightforward to construct. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects network-based exploitation with low attack complexity but mandatory user interaction. Once the user clicks, the token capture is automatic.

Remediation

Upgrade authentik to version 2026.2.3 or later. This version includes corrected URL parsing and validation logic for the wreply parameter. Organizations should prioritize this upgrade in their patching schedule, especially for instances used in production environments or accessible from untrusted networks. Review any authentication logs for suspicious wreply values or unusual redirect destinations post-compromise.

Patch guidance

Apply the authentik security update to version 2026.2.3 or newer. Verify the upgrade with the vendor's release notes and changelog to confirm the WS-Federation validation fix is included. For containerized deployments, pull the latest patched image tag; for binary or package-based installations, follow the vendor's standard update procedures. Test in a non-production environment first to ensure no compatibility issues with dependent applications before rolling out to production.

Detection guidance

Monitor authentication logs for wreply parameters that contain domain mismatches or that point to external URLs outside your organization's known domain list. Look for authentication tokens being exchanged with unexpected origins. Network-level detection can identify outbound HTTPS POST requests from your authentik instance to unfamiliar domains immediately after authentication events. Additionally, audit firewall and proxy logs for unauthenticated HTTP(S) connections from users' browsers to attacker infrastructure around the time they received authentication responses. Review WS-Federation metadata and configuration to ensure wreply validation is functioning as expected post-patch.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability directly compromises the authentication layer of an identity provider, making it a high-priority fix despite the user interaction requirement. Organizations should treat this as urgent because successful exploitation grants attackers signed authentication credentials that can be replayed against downstream applications. The availability of an authenticated patch and the well-understood attack pattern make remediation straightforward and should be elevated in the patch queue.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects the network-accessible nature of the vulnerability (AV:N), the low complexity of exploitation (AC:L), and the lack of required privileges (PR:N). The score is moderated by the requirement for user interaction (UI:R) and the changed security scope (S:C). While the confidentiality and integrity impacts are rated as low in the vector, the real-world impact—credential compromise at the identity layer—is strategically significant and warrants prioritization above the nominal CVSS rating.

Frequently asked questions