BIT-AUTHENTIK-2024-11623 Stored XSS in authentik

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release...

BIT-AUTHENTIK-2023-48228 OAuth2: PKCE can be fully circumvented

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

BIT-AUTHENTIK-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: open-webui, wazuh-manager, dagster, label-studio, nemo, pgadmin4-fips, tritonserver-backend-vllm-cuda-13.0, gitlab-cng-fips, kubeflow-pipelines-visualization-server, py3-cassandra-medusa, mitmproxy, opal, barman, datadog-agent, kserve, kubeflow-jupyter-web-app,...

CVE-2026-4292 vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

GHSA-5MF9-H53Q-7MHQ vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: open-webui, wazuh-manager, dagster, label-studio, nemo, pgadmin4-fips, tritonserver-backend-vllm-cuda-13.0, gitlab-cng-fips, kubeflow-pipelines-visualization-server, py3-cassandra-medusa, mitmproxy, opal, barman, datadog-agent, kserve, kubeflow-jupyter-web-app,...

GHSA-933H-HP56-HF7M vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

CVE-2026-4277 vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

GHSA-PWJP-CCJC-GHWG vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

CVE-2026-33034 vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

CVE-2026-3902 vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

GHSA-MMWR-2JHP-MC7J vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

CVE-2026-33033 vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

GHSA-MVFQ-GGXM-9MC5 vulnerabilities

Vulnerabilities for packages: awx, label-studio, authentik-fips, authentik...

GHSA-MJGH-79QC-68W3 vulnerabilities

Vulnerabilities for packages: awx, authentik-fips, label-studio...

CVE-2026-25674 vulnerabilities

Vulnerabilities for packages: awx, authentik-fips, label-studio...

GHSA-8P8V-WH79-9R56 vulnerabilities

Vulnerabilities for packages: awx, authentik-fips, label-studio...

CVE-2026-25673 vulnerabilities

Vulnerabilities for packages: awx, authentik-fips, label-studio...

CVE-2026-25922

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under...