CVE-2026-73088 vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-katib, arangodb, argo-workflows, authentik, gitlab-rails-ce-fips, tensorflow-gpu-jupyter, wazuh-dashboard-fips, wazuh-dashboard, gitlab-rails-ce, langfuse-fips, vitess, ts-patch, nextcloud-server, langfuse...

CVE-2026-73089 vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-katib, arangodb, argo-workflows, authentik, gitlab-rails-ce-fips, tensorflow-gpu-jupyter, wazuh-dashboard-fips, wazuh-dashboard, gitlab-rails-ce, langfuse-fips, vitess, ts-patch, nextcloud-server, langfuse...

GHSA-C83G-RGW3-J3CX vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-katib, arangodb, argo-workflows, authentik, gitlab-rails-ce-fips, tensorflow-gpu-jupyter, wazuh-dashboard-fips, wazuh-dashboard, gitlab-rails-ce, langfuse-fips, vitess, ts-patch, nextcloud-server, langfuse...

BIT-AUTHENTIK-2026-61574 authentik RAC: access any endpoint via an unrelated application

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

BIT-AUTHENTIK-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

BIT-AUTHENTIK-2026-55106 authentik: Unauthenticated LDAP directory data disclosure

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

BIT-AUTHENTIK-2026-54730 authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

PT-2026-79843

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

PT-2026-79842

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME LINK or EMAIL LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

PT-2026-79840

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

PT-2026-79841

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

GHSA-F2FF-P2WW-7P4P vulnerabilities

Vulnerabilities for packages: airflow-postgres-fips, mlflow, apache-beam-python-3.14-sdk, openstack-keystone-2026.1, mlflow-fips, mycli, openstack-glance-2026.1, openstack-placement-2025.2, openstack-keystone-2025.1, datahub-ingestion, pgadmin4, openstack-nova-2025.1,...

CVE-2026-54730

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

CVE-2026-61574

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

CVE-2026-55106

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

CVE-2026-57580

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

EUVD-2026-61062

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580

In authentik versions before 2026.2.6 and 2026.5.5, an inbound SAML Source using USERNAME_LINK or EMAIL_LINK matching interprets XML comments in a NameID differently than the signed assertion. An attacker who can set their NameID can inject a comment to truncate the value to a victim's username/e...

CVE-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...