Ggoauthentik

Products

Exploited and recent CVEs

• CVE-2026-94606 High 8.9 authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage 0.5%
• CVE-2026-94609 High 8.8 authentik: Privilege Escalation to Superuser via Group Hierarchy 0.5%
• CVE-2026-94611 High 8.1 authentik: Stored credentials are readable with view permission alone 0.3%
• CVE-2026-94612 High 7.4 authentik: Authentication bypass via assertion confusion in SAML sources 0.3%
• CVE-2026-94613 High 7.5 authentik: Denial of Service via Document Type Declarations in SAML Messages 0.6%
• CVE-2026-57580 Critical 9.4 authentik: Account Takeover via SAML NameID Comment Truncation 0.6%
• CVE-2026-55106 Medium 5.3 authentik: Unauthenticated LDAP directory data disclosure 0.4%
• CVE-2026-61574 High 8.8 authentik RAC: access any endpoint via an unrelated application 0.6%
• CVE-2026-54730 High 8.6 authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView 0.7%
• CVE-2026-49448 Critical 9.8 authentik: SourceStage bypass via empty POST 0.4%
• CVE-2026-49443 High 8.8 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API 0.3%
• CVE-2026-47201 High 8.5 authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user 0.2%
• CVE-2026-42849 Critical 9.3 authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover 0.3%
• CVE-2026-41569 Medium 6.9 authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints 0.2%
• CVE-2026-41577 Medium 6.9 authentik: SAML source does not validate Conditions, timing, or audience on assertions 0.2%
• CVE-2026-40172 High 8.1 authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser 0.5%
• CVE-2026-40166 High 7.1 authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/ 0.5%
• CVE-2026-40165 High 8.7 authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation 0.5%
• CVE-2026-25922 High 8.8 authentik has a Signature Verification Bypass via SAML Assertion Wrapping 0.2%
• CVE-2026-25748 High 8.6 authentik has a forward authentication bypass with broken cookie 0.7%
• CVE-2026-25227 Critical 9.1 authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint 0.9%
• CVE-2025-64708 Medium 5.8 authentik invitation expiry is delayed by at least 5 minutes 0.3%
• CVE-2025-64521 Medium 4.8 authentik deactivated service accounts can authenticate to OAuth 0.2%
• CVE-2025-53942 High 7.1 authentik has an insufficient check for account active status during OAuth/SAML authentication 0.6%
• CVE-2025-52553 Medium 5.5 authentik has Insufficient Session verification for Remote Access Control endpoint access 0.5%
• CVE-2025-29928 High 8.0 authentik's deletion of sessions did not revoke sessions when using database session storage 0.4%
• CVE-2024-11623 Medium 4.8 Stored XSS in authentik 0.3%
• CVE-2024-52287 Medium 6.4 authentik performs insufficient validation of OAuth scopes 0.6%
• CVE-2024-52289 High 7.9 authentik has an insecure default configuration for OAuth2 Redirect URIs 1.1%
• CVE-2024-52307 Medium 6.3 authentik allows a timing attack due to missing constant time comparison for metrics view 0.6%