goauthentik

Records45All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high22CVSS 7.0–8.9

Exploited now

goauthentik records in CISA KEV

No goauthentik vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Authentik 33 records HIGH

Records

33 records in Authentik · all components

TI-2026-36603 CVE-2026-49448

authentik: SourceStage bypass via empty POST

HIGH 82

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00405 Published 2026-06-02 Fixed in 2025.12.6, 2026.2.4 +1 CWE-287

TI-2022-07608 CVE-2022-23555

authentik vulnerable to Improper Authentication via invitation URL token reuse

HIGH 82

authentik is an open-source Identity Provider focused on flexibility and versatility.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00927 Published 2022-12-28 Fixed in 2022.11.4, 2022.10.4 CWE-287

TI-2026-36598 CVE-2026-49443

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

HIGH 73

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00298 Published 2026-06-02 Fixed in 2025.12.6, 2026.2.4 +1 CWE-287

TI-2022-22816 CVE-2022-46172

authentik allows existing authenticated users to create arbitrary accounts

MEDIUM 62

authentik is an open-source Identity provider focused on flexibility and versatility.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00565 Published 2022-12-28 Fixed in 2022.11.4, 2022.10.4 CWE-269

TI-2024-25628 CVE-2024-38371

Insufficient access control for OAuth2 Device Code flow in authentik

MEDIUM 49

authentik is an open-source Identity Provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0058 Published 2024-06-28 Fixed in 2024.6.0, 2024.4.3 +1 CWE-284

TI-2023-24876 CVE-2023-46249

authentik potential installation takeover when default admin user is deleted

MEDIUM 49

authentik is an open-source Identity Provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00795 Published 2023-10-31 Fixed in 2023.8.4, 2023.10.2 CWE-287

TI-2024-34964 CVE-2024-52289

authentik has an insecure default configuration for OAuth2 Redirect URIs

MEDIUM 45

authentik is an open-source identity provider.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.01091 Published 2024-11-21 Fixed in 2024.8.5, 2024.10.3 CWE-185

TI-2023-26092 CVE-2023-48228

OAuth2: PKCE can be fully circumvented

MEDIUM 45

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01247 Published 2023-11-21 Fixed in 2023.10.4, 2023.8.5 CWE-287

TI-2022-22789 CVE-2022-46145

authentik vulnerable to unauthorized user creation and potential account takeover

MEDIUM 45

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01279 Published 2022-12-02 Fixed in 2022.10.2, 2022.11.2 CWE-287

TI-2026-20816 CVE-2026-25748

authentik has a forward authentication bypass with broken cookie

MEDIUM 44

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00679 Published 2026-02-12 Fixed in 2025.10.4, 2025.12.4 CWE-287

TI-2026-20375 CVE-2026-25227

authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint

MEDIUM 43

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00891 Published 2026-02-12 Fixed in 2025.8.6, 2025.10.4 +1 CWE-94

TI-2023-18297 CVE-2023-36456

Authentik lacks Proxy IP headers validation

MEDIUM 43

authentik is an open-source Identity Provider.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.00794 Published 2023-07-06 Fixed in 2023.4.3, 2023.5.5 CWE-436

TI-2024-31452 CVE-2024-47070

authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header

MEDIUM 42

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00563 Published 2024-09-27 Fixed in 2024.8.3, 2024.6.5 CWE-287

TI-2024-25221 CVE-2024-37905

Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik

MEDIUM 41

authentik is an open-source Identity Provider that emphasizes flexibility and versatility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00757 Published 2024-06-28 Fixed in 2024.6.0, 2024.4.2 +1 CWE-284

TI-2024-15666 CVE-2024-23647 · GHSA-mrx3-gxjx-hjqj

PKCE downgrade attack in Authentik

MEDIUM 41

Authentik is an open-source Identity Provider.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00549 Published 2024-01-30 Fixed in 2023.8.7, 2023.10.7 CWE-287

TI-2023-11628 CVE-2023-26481

Insufficient user check in FlowTokens by Email stage

MEDIUM 41

authentik is an open-source Identity Provider.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00275 Published 2023-03-04 Fixed in 2023.2.3, 2023.1.3 +1 CWE-345

TI-2026-31057 CVE-2026-42849

authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00327 Published 2026-06-02 Fixed in 2025.12.5, 2026.2.3 CWE-79

TI-2026-20952 CVE-2026-25922

authentik has a Signature Verification Bypass via SAML Assertion Wrapping

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00241 Published 2026-02-12 Fixed in 2025.8.6, 2025.10.4 +1 CWE-287

TI-2026-34789 CVE-2026-47201 · GHSA-c3m2-jqmq-pvp3

authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

LOW 38

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00182 Published 2026-06-02 Fixed in 2025.12.5, 2026.2.3 +2 CWE-20

TI-2025-21310 CVE-2025-29928

authentik's deletion of sessions did not revoke sessions when using database session storage

LOW 37

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00394 Published 2025-03-28 Fixed in 2024.12.4, 2025.2.3 CWE-384

TI-2024-34962 CVE-2024-52287

authentik performs insufficient validation of OAuth scopes

LOW 37

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 6.4 Network High privileges No interaction EPSS 0.00577 Published 2024-11-21 Fixed in 2024.8.5, 2024.10.3 CWE-285

TI-2026-30124 CVE-2026-41569

authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints

LOW 36

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00175 Published 2026-06-02 Fixed in 2026.2.3 CWE-601

TI-2024-34982 CVE-2024-52307

authentik allows a timing attack due to missing constant time comparison for metrics view

LOW 35

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00553 Published 2024-11-21 Fixed in 2024.8.5, 2024.10.3 CWE-208

TI-2024-14362 CVE-2024-21637

XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode

LOW 34

Authentik is an open-source Identity Provider.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00547 Published 2024-01-11 No fix listed CWE-79

TI-2024-28458 CVE-2024-42490 · GHSA-qxqc-27pr-wgc8

authentik has Insufficient Authorization for several API endpoints

LOW 33

authentik is an open-source Identity Provider.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00477 Published 2024-08-22 Fixed in 2024.4.4, 2024.6.4 CWE-285

Open these records in search →