Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-57580, describes an account takeover scenario in authentik due to an XML comment truncation issue in SAML NameID and attribute processing. Specifically, when an inbound SAML Source was configured with USERNAME_LINK or EMAIL_LINK user-matching modes, authentik's XML parsing logic (prior to the fix) would incorrectly interpret XML comments within the NameID or attribute values. The core problem was the use of Element.text to extract these values, which would truncate the string at the point of an XML comment. However, the identity provider's signed assertion would remain valid because comment-excluding signature canonicalization strips comments before the digest is computed.
The provided patch (commits 6bd00f09f1f6b5bc5212a10340418fa1b264f02c and 8704a1b89d7bf46bcef0d3c434c821b937fdecc3) introduces a new utility function get_element_text in authentik/common/saml/utils.py. This function uses element.itertext() to correctly retrieve the full text content of an XML element, thereby preventing truncation by XML comments.
By analyzing the diffs, the SAMLSource.get_base_user_properties function in authentik/sources/saml/models.py is identified as the primary vulnerable component. This function was directly responsible for extracting user properties, including the username from the NameID and other attribute values, using the problematic value.text and name_id.text calls. An attacker could exploit this by crafting a SAML assertion where the NameID or an attribute value contained an XML comment, causing authentik to truncate the value and match it against a different, existing user account.
The change in authentik/sources/saml/processors/response.py to use get_element_text within _get_name_id is a refactoring for consistency, as the original code using itertext() was not vulnerable to the truncation issue. Therefore, the most precise identification of the vulnerable function is SAMLSource.get_base_user_properties due to its direct reliance on the flawed Element.text property for critical identity data.
SAMLSource.get_base_user_propertiesauthentik/sources/saml/models.py