CVE-2026-49448

Published: Jun 2, 2026Modified: Jul 22, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

Affected (3)

Products: Goauthentik: Authentik

Goauthentik

1 product

Authentik

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Goauthentik Authentik	Before 2025.12.6
Goauthentik Authentik	From 2026.2.0 to 2026.2.4
Goauthentik Authentik	From 2026.5.0 to 2026.5.1

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.