CVE-2026-25922

Estado: AnalizadaAlta (8.8)—

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.31%
Percentil entre todas las CVEs puntuadas: 22
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1078 Valid Accountsstealth · persistence · privilege escalation · initial access90 %
Impacto secundarioT1556 Modify Authentication Processdefense impairment · persistence · credential access80 %

Vulnerabilidad SAML en servicio remoto (AV:N, PR:L) que permite inyectar aserciones maliciosas. Impactos: falsificación de identidad (T1078) y control de autenticación (T1556).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management User Account Management Password Policies Multi-factor Authentication Application Developer Guidance Active Directory Configuration

Tecnologías afectadas (1)

Goauthentik — Authentik

CWE

CWE-287, CWE-347

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-25922",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25922",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-17T16:19:07.903041Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "goauthentik",
          "product": "authentik",
          "versions": [
            {
              "status": "affected",
              "version": "< 2025.8.6"
            },
            {
              "status": "affected",
              "version": ">= 2025.10.0-rc1, < 2025.10.4"
            },
            {
              "status": "affected",
              "version": ">= 2025.10.0-rc1, < 2025.12.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-12T20:16:10.910",
  "references": [
    {
      "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-jh35-c4cc-wjm4",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue."
    },
    {
      "lang": "es",
      "value": "authentik es un proveedor de identidad de código abierto. Antes de 2025.8.6, 2025.10.4 y 2025.12.4, al usar una Fuente SAML que tiene la opción Verificar Firma de Aserción bajo Certificado de Verificación habilitada y no Verificar Firma de Respuesta, o no tiene la configuración de Certificado de Cifrado bajo la configuración de Protocolo Avanzado configurada, era posible para un atacante inyectar una aserción maliciosa antes de la aserción firmada que authentik usaría en su lugar. authentik 2025.8.6, 2025.10.4 y 2025.12.4 solucionan este problema."
    }
  ],
  "lastModified": "2026-06-17T10:25:25.923",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "903E7E1D-C429-4016-BE4D-4336F534BB9A",
              "versionEndExcluding": "2025.8.6"
            },
            {
              "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B646FA7-6B60-4018-9EA8-0C3C4F18BC21",
              "versionEndExcluding": "2025.10.4",
              "versionStartIncluding": "2025.10.0"
            },
            {
              "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A59D4BC9-5FAE-4A4F-A109-D754BD80A10C",
              "versionEndExcluding": "2025.12.4",
              "versionStartIncluding": "2025.12.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}