authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.
References
| Link | Resource |
|---|---|
| https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4 | Product Release Notes |
| https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4 | Product Release Notes |
| https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6 | Product Release Notes |
| https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4 | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
18 Feb 2026, 20:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4 - Product, Release Notes | |
| References | () https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4 - Product, Release Notes | |
| References | () https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6 - Product, Release Notes | |
| References | () https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4 - Mitigation, Vendor Advisory | |
| CPE | cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* | |
| First Time |
Goauthentik authentik
Goauthentik |
12 Feb 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-12 20:16
Updated : 2026-02-18 20:59
NVD link : CVE-2026-25922
Mitre link : CVE-2026-25922
CVE.ORG link : CVE-2026-25922
JSON object : View
Products Affected
goauthentik
- authentik