Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M
CVE-2026-49448authentik: SourceStage bypass via empty POST
Critical 9.8
In plain English
A critical-severity improper authentication in authentik from goauthentik. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| goauthentik | authentik | < 2025.12.6< 2026.2.4< 2026.5.1 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8 x_refsource_CONFIRM