CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-86466

The apache-airflow-providers-fab package is vulnerable to an Origin Validation Error because the Authentik OAuth path in the FAB auth manager fails to validate the issuer or audience claims of accepted id_tokens. An attacker who possesses a valid token issued by the same Authentik identity provid...

CVE-2026-86466: Origin Validation Error

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

PT-2026-93421

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description The Authentik OAuth path in the FAB auth manager fails to validate the issuer or audience claims of the accepted id token. This allows an attacker who possesses a valid token...

authentik version/2026.8.2

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

CVE-2026-73088 vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-katib, langfuse-fips, nextcloud-server, authentik, langfuse, argo-workflows, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, wazuh-dashboard-fips, arangodb, commercial-gitlab-rails-ee, wazuh-dashboard, jupyter-base-notebook,...

GHSA-73WF-GQ98-2V4G vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-katib, langfuse-fips, nextcloud-server, authentik, langfuse, argo-workflows, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, wazuh-dashboard-fips, arangodb, commercial-gitlab-rails-ee, wazuh-dashboard, jupyter-base-notebook,...

CVE-2026-73089 vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-katib, langfuse-fips, nextcloud-server, authentik, langfuse, argo-workflows, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, wazuh-dashboard-fips, arangodb, commercial-gitlab-rails-ee, wazuh-dashboard, jupyter-base-notebook,...

GHSA-C83G-RGW3-J3CX vulnerabilities

Vulnerabilities for packages: authentik-fips, kubeflow-katib, langfuse-fips, nextcloud-server, authentik, langfuse, argo-workflows, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, wazuh-dashboard-fips, arangodb, commercial-gitlab-rails-ee, wazuh-dashboard, jupyter-base-notebook,...

BIT-AUTHENTIK-2026-61574 authentik RAC: access any endpoint via an unrelated application

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

BIT-AUTHENTIK-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

BIT-AUTHENTIK-2026-55106 authentik: Unauthenticated LDAP directory data disclosure

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

BIT-AUTHENTIK-2026-54730 authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

PT-2026-79842

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME LINK or EMAIL LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

PT-2026-79840

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage wit...

PT-2026-79841

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

PT-2026-79843

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

GHSA-F2FF-P2WW-7P4P vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-keystone-2025.2-fips, mycli, netbox, openstack-glance-2025.2, openstack-placement-2026.1-fips, apache-beam-python-3.14-sdk, openstack-glance-2026.1, openstack-glance-2025.2-fips, openstack-keystone-2026.1, openstack-glance-2025.1,...

CVE-2026-61574

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

CVE-2026-57580

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...