Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability affects the authentik identity provider, a system managing user access. If an attacker can influence how user identities are presented, they could potentially hijack existing user accounts to gain unauthorized access. The primary concern is confirming if this specific configuration is in use.
- Attackers could seize user accounts.
- It impacts how user identities are managed.
- Confirm if this specific configuration is in use.
Attack Path
How an attacker could exploit the issue
An attacker with an account on a connected identity provider can exploit a misconfiguration in Authentik's SAML handling. By crafting a specific NameID value that includes an XML comment, the attacker can trick Authentik into associating their external identity with a victim's existing account. This allows the attacker to gain full control over the victim's account without needing their password or the identity provider's private key.
- Requires an attacker-controlled account on a connected IdP.
- Truncates NameID to link attacker to victim account.
- Full account takeover and persistent malicious access.
Live Threat
Current exploitation, exposure, and threat context
When configured with specific user-matching modes, authentik could allow an attacker with an account on a source identity provider to inject an XML comment into the NameID. This comment could truncate the value used by authentik, effectively linking the attacker's external identity to a victim's existing account. This could lead to a full account takeover without requiring the victim's password or the identity provider's private key.
- User account access.
- Malicious NameID injection.
- Full account takeover.
Operational Fix
Recommended remediation, mitigation, and detection steps
Security teams managing the authentik identity provider are responsible for addressing this critical vulnerability. The first practical step is to identify all instances of authentik, determine if they are internet-facing or handle sensitive data, and confirm the accountable owner before planning remediation.
- Authentik administrators own this issue.
- Verify SAML Source USERNAME_LINK/EMAIL_LINK configurations.
- Plan remediation based on identified risk.
