CVE-2026-94613 goauthentik CVE debrief

Who should care

Defenders responsible for authentik deployments, particularly those using SAML in either the identity-provider or SAML source role, should assess their exposure to this vulnerability and apply patches to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-94613 is a high-severity denial-of-service vulnerability in authentik that can be exploited by an unauthenticated attacker. Defenders should prioritize verifying their deployments for exposure and applying patches to prevent potential attacks.

• Denial-of-service attacks may cause sustained failure of legitimate traffic
• Verification of authentik deployments for exposure is necessary
• Patching to versions 2026.2.7, 2026.5.7, and 2026.8.2 is required to fix the vulnerability

Technical summary

CVE-2026-94613 is a denial-of-service vulnerability in authentik, an open-source identity provider. An unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role, causing the worker handling /application/saml/* or /source/saml/* to stop and resulting in failed requests. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Defenders should prioritize verifying their authentik deployments for exposure and applying the available patches (versions 2026.2.7, 2026.5.7, and 2026.8.2) to prevent the 7

Defensive priority

Defenders should prioritize verifying their authentik deployments for exposure and applying the available patches (versions 2026.2.7, 2026.5.7, and 2026.8.2) to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify authentik deployments for exposure to CVE-2026-94613
• Apply patches (versions 2026.2.7, 2026.5.7, and 2026.8.2) to prevent potential denial-of-service attacks
• Monitor for suspicious SAML messages
• Review and update incident response plans
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vendor, goauthentik, has released patches for the issue. Defenders should verify the affected versions of authentik and apply patches to prevent potential denial-of-service attacks. The evidence is limited, and further verification is necessary to confirm the scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.