Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M
CVE-2026-42849authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
Critical 9.3
In plain English
A critical-severity cross-site scripting in authentik from goauthentik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.3%top 74.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| goauthentik | authentik | < 2025.12.5< 2026.2.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/goauthentik/authentik/security/advisories/GHSA-pgff-5mx8-fqj3 x_refsource_CONFIRM