CVE-2026-57580 with a CVSS score of 9.4 is a vulnerability that allows an attacker to use an XML comment inside a SAML NameID value, which can link an attacker-controlled external identity to the victim’s account, creating a persistent path to account takeover. The flaw affects Authentik, an open-source identity provider, and was discovered using an AI-assisted testing harness built around Claude Opus. The vulnerability is caused by inconsistent parser behavior in XML signature processing and allows attackers to bypass authentication and take over user accounts. It can be exploited before authentication and involves SAML signature wrapping techniques. The research also uncovered weaknesses beyond standard SAML login responses, including signature validation bypasses in authentication requests, attribute queries, and logout operations that can enable information disclosure or arbitrary user logouts.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-57580 with a CVSS score of 9.4 is a vulnerability that allows an attacker to use an XML comment inside a SAML NameID value, which can link an attacker-controlled external identity to the victim’s account, creating a persistent path to account takeover. The flaw affects Authentik, an open-source identity provider, and was discovered using an AI-assisted testing harness built around Claude Opus. The vulnerability is caused by inconsistent parser behavior in XML signature processing and allows attackers to bypass authentication and take over user accounts. It can be exploited before authentication and involves SAML signature wrapping techniques. The research also uncovered weaknesses beyond standard SAML login responses, including signature validation bypasses in authentication requests, attribute queries, and logout operations that can enable information disclosure or arbitrary user logouts.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]