authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

GHSA-42VR-XJ54-VC7V vulnerabilities

Vulnerabilities for packages: openstack-barbican-2026.1, openstack-keystone-2026.1, kserve, netbox-fips, openstack-placement-2026.1, datadog-agent, openstack-octavia-2026.1, mlrun, request-1276, openstack-designate-2026.1, openstack-heat-2025.2, openstack-designate-2025.2, authentik-fips,...

CVE-2026-101918 vulnerabilities

Vulnerabilities for packages: openstack-barbican-2026.1, openstack-keystone-2026.1, kserve, netbox-fips, openstack-placement-2026.1, datadog-agent, openstack-octavia-2026.1, mlrun, request-1276, openstack-designate-2026.1, openstack-heat-2025.2, openstack-designate-2025.2, authentik-fips,...

GHSA-JWRC-G2Q2-PQ5P vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips...

CVE-2026-103001 vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips...

GHSA-GVP8-978C-RX2Q vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips...

CVE-2026-102270 vulnerabilities

Vulnerabilities for packages: authentik-fips, superset-fips...

CVE-2026-94609

CVE-2026-94609 — authentik Privilege Escalation via Delegated Group/User Management -important Write-up and proof-of-concept for a privilege-escalation vulnerability in goauthentik/authentik, fixed in 2026.2.7 / 2026.5.7 / 2026.8.2 and assigned CVE-2026-94609 GHSA-h6c5-mpvq-j4jc. I was one of the...

BIT-AUTHENTIK-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

GHSA-8V8H-HG4W-MVQ2 vulnerabilities

Vulnerabilities for packages: authentik, airflow...

CVE-2026-59980 vulnerabilities

Vulnerabilities for packages: authentik, airflow...

Exploit for CVE-2026-94609

CVE-2026-94609 — authentik Privilege Escalation via Delegated...

CVE-2026-94612

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

CVE-2026-94609

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-94611

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94606

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

CVE-2026-94613

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

EUVD-2026-86280

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

CVE-2026-94606 authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

CVE-2026-94606 authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...