Account takeover via NameID comment truncation

Authentication bypass in authentik before 2026.2.6 and 2026.5.5 lets remote authenticated users take over accounts via NameID comment injection. In affected inbound SAML Sources, the code reads NameID and attribute values with Element.text, which stops at the first child node, so an embedded XML comment truncates the value that authentik matches while the signed assertion still covers the full text. Exploitation requires a signed inbound assertion, the non-default USERNAME_LINK or EMAIL_LINK mode, and an attacker-controlled source IdP account; the malicious external-identity link then persists for later logins.