goauthentik

Records45All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high22CVSS 7.0–8.9

Exploited now

goauthentik records in CISA KEV

No goauthentik vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Authentik 33 records HIGH

Records

45 records

TI-2026-36603 CVE-2026-49448

authentik: SourceStage bypass via empty POST

HIGH 82

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00405 Published 2026-06-02 Fixed in 2025.12.6, 2026.2.4 +1 CWE-287

TI-2022-07608 CVE-2022-23555

authentik vulnerable to Improper Authentication via invitation URL token reuse

HIGH 82

authentik is an open-source Identity Provider focused on flexibility and versatility.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00927 Published 2022-12-28 Fixed in 2022.11.4, 2022.10.4 CWE-287

TI-2026-36598 CVE-2026-49443

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

HIGH 73

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00298 Published 2026-06-02 Fixed in 2025.12.6, 2026.2.4 +1 CWE-287

TI-2022-22816 CVE-2022-46172

authentik allows existing authenticated users to create arbitrary accounts

MEDIUM 62

authentik is an open-source Identity provider focused on flexibility and versatility.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00565 Published 2022-12-28 Fixed in 2022.11.4, 2022.10.4 CWE-269

TI-2026-41431 CVE-2026-57580

authentik: Account Takeover via SAML NameID Comment Truncation

MEDIUM 49

authentik is an open-source identity provider.

CVSS 4.0CRITICAL 9.4 Network No auth No interaction EPSS 0.0059 Published 2026-08-18 Fixed in 2026.2.6, 2026.5.5 CWE-436

TI-2024-25628 CVE-2024-38371

Insufficient access control for OAuth2 Device Code flow in authentik

MEDIUM 49

authentik is an open-source Identity Provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0058 Published 2024-06-28 Fixed in 2024.6.0, 2024.4.3 +1 CWE-284

TI-2023-24876 CVE-2023-46249

authentik potential installation takeover when default admin user is deleted

MEDIUM 49

authentik is an open-source Identity Provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00795 Published 2023-10-31 Fixed in 2023.8.4, 2023.10.2 CWE-287

TI-2024-34964 CVE-2024-52289

authentik has an insecure default configuration for OAuth2 Redirect URIs

MEDIUM 45

authentik is an open-source identity provider.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.01091 Published 2024-11-21 Fixed in 2024.8.5, 2024.10.3 CWE-185

TI-2023-26092 CVE-2023-48228

OAuth2: PKCE can be fully circumvented

MEDIUM 45

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01247 Published 2023-11-21 Fixed in 2023.10.4, 2023.8.5 CWE-287

TI-2022-22789 CVE-2022-46145

authentik vulnerable to unauthorized user creation and potential account takeover

MEDIUM 45

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01279 Published 2022-12-02 Fixed in 2022.10.2, 2022.11.2 CWE-287

TI-2026-20816 CVE-2026-25748

authentik has a forward authentication bypass with broken cookie

MEDIUM 44

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00679 Published 2026-02-12 Fixed in 2025.10.4, 2025.12.4 CWE-287

TI-2026-20375 CVE-2026-25227

authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint

MEDIUM 43

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00891 Published 2026-02-12 Fixed in 2025.8.6, 2025.10.4 +1 CWE-94

TI-2023-18297 CVE-2023-36456

Authentik lacks Proxy IP headers validation

MEDIUM 43

authentik is an open-source Identity Provider.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.00794 Published 2023-07-06 Fixed in 2023.4.3, 2023.5.5 CWE-436

TI-2024-31452 CVE-2024-47070

authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header

MEDIUM 42

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00563 Published 2024-09-27 Fixed in 2024.8.3, 2024.6.5 CWE-287

TI-2026-63472 CVE-2026-94609

authentik: Privilege Escalation to Superuser via Group Hierarchy

MEDIUM 41

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00514 Published 2026-09-24 Fixed in 2026.2.7, 2026.5.7 +1 CWE-269

TI-2026-63471 CVE-2026-94606

authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

MEDIUM 41

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.9 Network No auth No interaction EPSS 0.00489 Published 2026-09-24 Fixed in 2026.2.7, 2026.5.7 +1 CWE-287

TI-2026-44115 CVE-2026-61574

authentik RAC: access any endpoint via an unrelated application

MEDIUM 41

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00624 Published 2026-08-18 Fixed in 2026.2.6, 2026.5.5 CWE-639

TI-2024-25221 CVE-2024-37905

Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik

MEDIUM 41

authentik is an open-source Identity Provider that emphasizes flexibility and versatility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00757 Published 2024-06-28 Fixed in 2024.6.0, 2024.4.2 +1 CWE-284

TI-2024-15666 CVE-2024-23647 · GHSA-mrx3-gxjx-hjqj

PKCE downgrade attack in Authentik

MEDIUM 41

Authentik is an open-source Identity Provider.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00549 Published 2024-01-30 Fixed in 2023.8.7, 2023.10.7 CWE-287

TI-2023-11628 CVE-2023-26481

Insufficient user check in FlowTokens by Email stage

MEDIUM 41

authentik is an open-source Identity Provider.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00275 Published 2023-03-04 Fixed in 2023.2.3, 2023.1.3 +1 CWE-345

TI-2026-63475 CVE-2026-94613

authentik: Denial of Service via Document Type Declarations in SAML Messages

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00643 Published 2026-09-24 Fixed in 2026.2.7, 2026.5.7 +1 CWE-770

TI-2026-39543 CVE-2026-54730

Improper access control in goauthentik authentik

MEDIUM 40

authentik is an open-source identity provider.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.0068 Published 2026-08-18 Fixed in 2026.2.6, 2026.5.5 CWE-284

TI-2026-31057 CVE-2026-42849

authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00327 Published 2026-06-02 Fixed in 2025.12.5, 2026.2.3 CWE-79

TI-2026-28980 CVE-2026-40165

authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00502 Published 2026-05-20 Fixed in 2025.12.5, 2026.2.3 CWE-287

TI-2026-20952 CVE-2026-25922

authentik has a Signature Verification Bypass via SAML Assertion Wrapping

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00241 Published 2026-02-12 Fixed in 2025.8.6, 2025.10.4 +1 CWE-287

Open these records in search →