CVE-2026-47201
1 advisory.
Go/goauthentik.io CVE-2026-47201: high 8.5
authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
Action: Upgrade goauthentik.io to 0.0.0-20260528144335-a370d76d23c7 or later.
go get goauthentik.io@v0.0.0-20260528144335-a370d76d23c7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
| 0.0.0-20260528144335-a370d76d23c7 |
Sources
- osv: GHSA-c3m2-jqmq-pvp3
- https://github.com/goauthentik/authentik/security/advisories/GHSA-c3m2-jqmq-pvp3
- https://nvd.nist.gov/vuln/detail/CVE-2026-47201
- https://github.com/goauthentik/authentik/commit/a370d76d23c7de0fceed064ca322e33e6ebf0119
- https://github.com/goauthentik/authentik
CVE-2026-47201 · published · modified · JSON