CVE-2026-49448

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8	Exploit Vendor Advisory
https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:goauthentik:authentik::::::::
	cpe:2.3:a:goauthentik:authentik::::::::
	cpe:2.3:a:goauthentik:authentik::::::::

History

No history.

Information

Published : 2026-06-02 21:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-49448

Mitre link : CVE-2026-49448

CVE.ORG link : CVE-2026-49448

JSON object : View

Products Affected

goauthentik

authentik

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-49448", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49448", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-03T12:46:21.867335Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"status": "affected", "version": "< 2025.12.6"}, {"status": "affected", "version": "< 2026.2.4"}, {"status": "affected", "version": "< 2026.5.1"}]}]}], "published": "2026-06-02T21:16:28.490", "references": [{"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1."}, {"lang": "es", "value": "authentik es un proveedor de identidad de c\u00f3digo abierto. Antes de las versiones 2025.12.6, 2026.2.4 y 2026.5.1, la etapa Source puede ser eludida enviando un POST vac\u00edo. Este problema ha sido parcheado en las versiones 2025.12.6, 2026.2.4 y 2026.5.1."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2248E771-C089-49F8-B370-D3E089534A60", "versionEndExcluding": "2025.12.6"}, {"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2723A03F-6FA5-40D6-9D67-320CBC6538C4", "versionEndExcluding": "2026.2.4", "versionStartIncluding": "2026.2.0"}, {"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D092DE78-A8F3-4569-80F8-0289DF27CB2D", "versionEndExcluding": "2026.5.1", "versionStartIncluding": "2026.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}