Authentik SAML Assertion Validation Vulnerability Allowing Replay of Expired Assertions

A vulnerability exists in authentik, an open-source identity provider, in versions prior to 2025.12.5 and 2026.2.3. The issue arises in the SAML source response processor, specifically in the 'ResponseProcessor.parse()' method', which fails to validate the 'Conditions' element on assertions. This oversight allows the replay of expired assertions and the acceptance of assertions meant for other service providers.

Impact

Exploitation of this vulnerability allows users to replay valid SAML assertions at any time, even after the assertions have expired.

Remediation

Users can upgrade to authentik versions 2025.12.5 or 2026.2.3 to address this vulnerability. For versions prior to 2025.12.5 and 2026.2.3, a workaround is available.