Vulnerabilities

TI-2026-36603 CVE-2026-49448

authentik: SourceStage bypass via empty POST

HIGH 82

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00405 Published 2026-06-02 Fixed in 2025.12.6, 2026.2.4 +1 CWE-287

TI-2026-36598 CVE-2026-49443

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

HIGH 73

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00298 Published 2026-06-02 Fixed in 2025.12.6, 2026.2.4 +1 CWE-287

TI-2026-34789 CVE-2026-47201 · GHSA-c3m2-jqmq-pvp3

authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

LOW 38

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00182 Published 2026-06-02 Fixed in 2025.12.5, 2026.2.3 +2 CWE-20

TI-2026-31057 CVE-2026-42849

authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00327 Published 2026-06-02 Fixed in 2025.12.5, 2026.2.3 CWE-79

TI-2026-30124 CVE-2026-41569

authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints

LOW 36

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00175 Published 2026-06-02 Fixed in 2026.2.3 CWE-601

TI-2026-30132 CVE-2026-41577

authentik: SAML source does not validate Conditions, timing, or audience on assertions

LOW 30

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00169 Published 2026-06-02 Fixed in 2025.12.5, 2026.2.3 CWE-345

TI-2026-20952 CVE-2026-25922

authentik has a Signature Verification Bypass via SAML Assertion Wrapping

MEDIUM 40

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00238 Published 2026-02-12 Fixed in 2025.8.6, 2025.10.4 +1 CWE-287

TI-2026-20816 CVE-2026-25748

authentik has a forward authentication bypass with broken cookie

MEDIUM 44

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00669 Published 2026-02-12 Fixed in 2025.10.4, 2025.12.4 CWE-287

TI-2026-20375 CVE-2026-25227

authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint

MEDIUM 43

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00877 Published 2026-02-12 Fixed in 2025.8.6, 2025.10.4 +1 CWE-94

TI-2025-40054 CVE-2025-64708 · GHSA-ch7q-53v8-73pc

authentik invitation expiry is delayed by at least 5 minutes

LOW 32

authentik is an open-source Identity Provider.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00265 Published 2025-11-19 Fixed in 2025.10.2, 2025.8.5 +1 CWE-613

TI-2025-39911 CVE-2025-64521 · GHSA-xr73-jq5p-ch8r

authentik deactivated service accounts can authenticate to OAuth

LOW 22

authentik is an open-source Identity Provider.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00234 Published 2025-11-19 Fixed in 2025.10.2, 2025.8.5 +1 CWE-289

TI-2025-33807 CVE-2025-53942 · GHSA-9g4j-v8w5-7x42

authentik has an insufficient check for account active status during OAuth/SAML authentication

LOW 32

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols.

CVSS 4.0HIGH 7.1 Network No auth No interaction EPSS 0.00579 Published 2025-07-23 Fixed in 2025.6.4, 0.0.0-20250722122105-7a4c6b9b50f8 CWE-269

TI-2025-32648 CVE-2025-52553

authentik has Insufficient Session verification for Remote Access Control endpoint access

LOW 25

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 5.5 Network No auth User interaction EPSS 0.00522 Published 2025-06-27 Fixed in 2025.6.3, 2025.4.3 CWE-287

TI-2025-21310 CVE-2025-29928

authentik's deletion of sessions did not revoke sessions when using database session storage

LOW 37

authentik is an open-source identity provider.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00394 Published 2025-03-28 Fixed in 2024.12.4, 2025.2.3 CWE-384

TI-2024-10770 CVE-2024-11623 · GHSA-f8wx-qvvq-mwx4

Stored XSS in authentik

LOW 22

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00297 Published 2025-02-04 Fixed in 2024.10.4 CWE-79

TI-2024-34962 CVE-2024-52287

authentik performs insufficient validation of OAuth scopes

LOW 37

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 6.4 Network High privileges No interaction EPSS 0.00577 Published 2024-11-21 Fixed in 2024.8.5, 2024.10.3 CWE-285

TI-2024-34964 CVE-2024-52289

authentik has an insecure default configuration for OAuth2 Redirect URIs

MEDIUM 45

authentik is an open-source identity provider.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.01091 Published 2024-11-21 Fixed in 2024.8.5, 2024.10.3 CWE-185

TI-2024-34982 CVE-2024-52307

authentik allows a timing attack due to missing constant time comparison for metrics view

LOW 35

authentik is an open-source identity provider.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00553 Published 2024-11-21 Fixed in 2024.8.5, 2024.10.3 CWE-208

TI-2024-31459 CVE-2024-47077

authentik cross-provider token validation problems

LOW 29

authentik is an open-source identity provider.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00414 Published 2024-09-27 Fixed in 2024.8.3, 2024.6.5 CWE-863

TI-2024-31452 CVE-2024-47070

authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header

MEDIUM 42

authentik is an open-source identity provider.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00563 Published 2024-09-27 Fixed in 2024.8.3, 2024.6.5 CWE-287

TI-2024-28458 CVE-2024-42490 · GHSA-qxqc-27pr-wgc8

authentik has Insufficient Authorization for several API endpoints

LOW 33

authentik is an open-source Identity Provider.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00477 Published 2024-08-22 Fixed in 2024.4.4, 2024.6.4 CWE-285

TI-2024-25628 CVE-2024-38371

Insufficient access control for OAuth2 Device Code flow in authentik

MEDIUM 49

authentik is an open-source Identity Provider.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0058 Published 2024-06-28 Fixed in 2024.6.0, 2024.4.3 +1 CWE-284

TI-2024-25221 CVE-2024-37905

Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik

MEDIUM 41

authentik is an open-source Identity Provider that emphasizes flexibility and versatility.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00757 Published 2024-06-28 Fixed in 2024.6.0, 2024.4.2 +1 CWE-284

TI-2024-15666 CVE-2024-23647 · GHSA-mrx3-gxjx-hjqj

PKCE downgrade attack in Authentik

MEDIUM 41

Authentik is an open-source Identity Provider.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00549 Published 2024-01-30 Fixed in 2023.8.7, 2023.10.7 CWE-287

TI-2024-14362 CVE-2024-21637

XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode

LOW 34

Authentik is an open-source Identity Provider.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00547 Published 2024-01-11 No fix listed CWE-79

Vulnerabilities

Filters