Goauthentik Authentik vulnerabilities

• goauthentik authentik authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage CVE-2026-94606 Fix available 8.9 HighSeptember 24, 2026
• goauthentik authentik authentik: Privilege Escalation to Superuser via Group Hierarchy CVE-2026-94609 Public exploitFix available 8.8 HighSeptember 24, 2026
• goauthentik authentik authentik: Stored credentials are readable with view permission alone CVE-2026-94611 Fix available 8.1 HighSeptember 24, 2026
• goauthentik authentik authentik: Authentication bypass via assertion confusion in SAML sources CVE-2026-94612 Fix available 7.4 HighSeptember 24, 2026
• goauthentik authentik authentik: Denial of Service via Document Type Declarations in SAML Messages CVE-2026-94613 Fix available 7.5 HighSeptember 24, 2026
• goauthentik authentik authentik: Account Takeover via SAML NameID Comment Truncation CVE-2026-57580 Fix available 9.4 CriticalAugust 18, 2026
• goauthentik authentik authentik: Unauthenticated LDAP directory data disclosure CVE-2026-55106 Fix available 5.3 MediumAugust 18, 2026
• goauthentik authentik authentik RAC: access any endpoint via an unrelated application CVE-2026-61574 Fix available 8.8 HighAugust 18, 2026
• goauthentik authentik authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView CVE-2026-54730 Fix available 8.6 HighAugust 18, 2026
• authentik security authentik Authentik Security authentik - Privilege Escalation CVE-2026-72537 8.8 HighAugust 11, 2026
• authentik security authentik Authentik Security authentik - Privilege Escalation CVE-2026-72534 8.8 HighAugust 11, 2026
• goauthentik authentik authentik: SourceStage bypass via empty POST CVE-2026-49448 Fix available 9.8 CriticalJune 2, 2026
• goauthentik authentik authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API CVE-2026-49443 Fix available 8.8 HighJune 2, 2026
• goauthentik authentik authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover CVE-2026-42849 Fix available 9.3 CriticalJune 2, 2026
• goauthentik authentik authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints CVE-2026-41569 Fix available 6.9 MediumJune 2, 2026
• goauthentik authentik authentik: SAML source does not validate Conditions, timing, or audience on assertions CVE-2026-41577 Fix available 6.9 MediumJune 2, 2026
• goauthentik authentik authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user CVE-2026-47201 Fix available 8.5 HighMay 29, 2026
• goauthentik authentik authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser CVE-2026-40172 Fix available 8.1 HighMay 22, 2026
• goauthentik authentik authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/ CVE-2026-40166 Fix available 7.1 HighMay 22, 2026
• goauthentik authentik authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation CVE-2026-40165 Fix available 8.7 HighMay 20, 2026
• goauthentik authentik authentik has a Signature Verification Bypass via SAML Assertion Wrapping CVE-2026-25922 Fix available 8.8 HighFebruary 12, 2026
• goauthentik authentik authentik has a forward authentication bypass with broken cookie CVE-2026-25748 Fix available 8.6 HighFebruary 12, 2026
• goauthentik authentik authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint CVE-2026-25227 Fix available 9.1 CriticalFebruary 12, 2026
• goauthentik authentik authentik invitation expiry is delayed by at least 5 minutes CVE-2025-64708 Fix available 5.8 MediumNovember 19, 2025
• goauthentik authentik authentik deactivated service accounts can authenticate to OAuth CVE-2025-64521 Fix available 4.8 MediumNovember 19, 2025
• goauthentik authentik authentik has an insufficient check for account active status during OAuth/SAML authentication CVE-2025-53942 Fix available 7.1 HighJuly 22, 2025
• goauthentik authentik authentik has Insufficient Session verification for Remote Access Control endpoint access CVE-2025-52553 Fix available 5.5 MediumJune 27, 2025
• goauthentik authentik authentik's deletion of sessions did not revoke sessions when using database session storage CVE-2025-29928 Fix available 8.0 HighMarch 28, 2025
• goauthentik authentik Stored XSS in authentik CVE-2024-11623 Fix available 4.8 MediumFebruary 4, 2025
• goauthentik authentik authentik performs insufficient validation of OAuth scopes CVE-2024-52287 Fix available 6.4 MediumNovember 21, 2024
• goauthentik authentik authentik has an insecure default configuration for OAuth2 Redirect URIs CVE-2024-52289 Fix available 7.9 HighNovember 21, 2024
• goauthentik authentik authentik allows a timing attack due to missing constant time comparison for metrics view CVE-2024-52307 Fix available 6.3 MediumNovember 21, 2024
• goauthentik authentik authentik cross-provider token validation problems CVE-2024-47077 Fix available 6.5 MediumSeptember 27, 2024
• goauthentik authentik authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header CVE-2024-47070 Fix available 9.1 CriticalSeptember 27, 2024
• goauthentik authentik authentik has Insufficient Authorization for several API endpoints CVE-2024-42490 Fix available 7.5 HighAugust 22, 2024
• goauthentik authentik Insufficient access control for OAuth2 Device Code flow in authentik CVE-2024-38371 Fix available 8.6 HighJune 28, 2024
• goauthentik authentik Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik CVE-2024-37905 Fix available 8.8 HighJune 28, 2024
• goauthentik authentik PKCE downgrade attack in Authentik CVE-2024-23647 Fix available 6.5 MediumJanuary 29, 2024
• goauthentik authentik XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode CVE-2024-21637 Fix available 7.7 HighJanuary 11, 2024
• goauthentik authentik OAuth2: PKCE can be fully circumvented CVE-2023-48228 Fix available 7.5 HighNovember 21, 2023
• goauthentik authentik authentik potential installation takeover when default admin user is deleted CVE-2023-46249 Fix available 9.7 CriticalOctober 31, 2023
• goauthentik authentik Username enumeration attack in goauthentik CVE-2023-39522 Fix available 5.3 MediumAugust 29, 2023
• goauthentik authentik Authentik lacks Proxy IP headers validation CVE-2023-36456 Fix available 8.3 HighJuly 6, 2023
• goauthentik authentik Insufficient user check in FlowTokens by Email stage CVE-2023-26481 Fix available 9.1 CriticalMarch 4, 2023
• goauthentik authentik authentik allows existing authenticated users to create arbitrary accounts CVE-2022-46172 Fix available 6.4 MediumDecember 28, 2022
• goauthentik authentik authentik vulnerable to Improper Authentication via invitation URL token reuse CVE-2022-23555 Fix available 9.4 CriticalDecember 28, 2022
• goauthentik authentik authentik vulnerable to unauthorized user creation and potential account takeover CVE-2022-46145 Fix available 8.1 HighDecember 2, 2022