CVE-2026-94606

The open-source identity provider authentik is vulnerable to an MFA Bypass via state confusion and parameter injection in the AuthenticatorEmailStage . Prior to versions 2026.2.7, 2026.5.7, and 2026.8.2 , the system accepts an email address supplied in the setup request rather than the one establ...