The critical vulnerability in CVE-2026-57580 isn't the XML comment injection itself—it's that authentik's SAML parser and signature verifier operate on different interpretations of the same assertion. The XML parser sees a comment within the NameID element and truncates it when extracting the value for user matching. The signature, however, remains valid because it was computed over the well-formed XML containing the comment. The result: a technically valid signature over content that differs from what authentik actually acts upon.
This parsing differential becomes a mass account takeover vector because of how USERNAME_LINK and EMAIL_LINK modes work. These convenience features match incoming assertions against existing users based on email or username—the exact values the IdP controls. An attacker with a single throwaway IdP account can iterate through potential targets and bind their external identity to any victim account whose email or username they can guess. One attacker account, unlimited targets. That's a 1-to-N conversion that most authentication vulnerabilities don't enable.
The exploit persists beyond the attack window. Once the binding is created, subsequent logins succeed normally—the attacker doesn't need to replay the malformed assertion. They just log in as the victim using their linked external identity. The patch doesn't automatically revoke existing bindings.
Your priority check: determine whether the fix in 2026.2.6/2026.5.5 canonicalizes the NameID value before signature verification (addressing the root parsing differential) or simply rejects comments in NameID fields (treating a symptom). If it's the latter, other parser differentials—namespace handling, entity expansion, whitespace normalization—could still be exploitable. The broader question is whether USERNAME_LINK and EMAIL_LINK modes are survivable at all, given that they fundamentally depend on IdP-controlled values for security-critical matching in a protocol where the IdP is an untrusted party.