CVE-2026-49443

Published: Jun 2, 2026Modified: Jul 22, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

Affected (3)

Products: Goauthentik: Authentik

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Goauthentik Authentik	Before 2025.12.6
Goauthentik Authentik	From 2026.2.0 to 2026.2.4
Goauthentik Authentik	From 2026.5.0 to 2026.5.1

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://github.com/goauthentik/authentik/security/advisories/GHSA-wr38-7xg8-fqxr

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/goauthentik/authentik/security/advisories/GHSA-wr38-7xg8-fqxr

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.