GHSA-R28C-9Q8G-F849 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse-fips, vitess, librechat, authentik-fips, langfuse, homepage...

GHSA-PM4M-PH32-GHV5 vulnerabilities

Vulnerabilities for packages: authentik-fips...

CVE-2026-45623 vulnerabilities

Vulnerabilities for packages: langfuse, authentik-fips, langfuse-fips, vitess...

GHSA-6G55-P6WH-862Q vulnerabilities

Vulnerabilities for packages: langfuse, authentik-fips, langfuse-fips, vitess...

CVE-2026-7666 vulnerabilities

Vulnerabilities for packages: authentik, authentik-fips...

GHSA-MM6V-Q8Q9-PGCF vulnerabilities

Vulnerabilities for packages: authentik, authentik-fips...

PT-2026-56530

The security advisory for CVE-2026-57580 has been published: https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992 The security advisory for CVE-2026-54730 has been published: https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx The security...

PT-2026-56531

The security advisory for CVE-2026-57580 has been published: https://github.com/goauthentik/authentik/security/advisories/GHSA-35v6-hv2g-6992 The security advisory for CVE-2026-54730 has been published: https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx The security...

GHSA-6V7P-G79W-8964 vulnerabilities

Vulnerabilities for packages: nemo, py3-pipenv, airflow, openstack-kolla-toolbox-2026.1, openstack-placement-2026.1, openstack-placement-2026.1-fips, openstack-glance-2026.1-fips, openstack-kolla-toolbox-2026.1-fips, mitmproxy, openstack-glance-2026.1, dbt-bigquery, authentik, datadog-agent-fips,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: undock, crossplane-provider-aws-sns, seaweedfs-rocksdb-fips, cerbos, aws-node-termination-handler, cert-manager-csi-driver-fips, crossplane-provider-aws-scheduler, ingress-nginx-controller-fips, crossplane-provider-aws-autoscaling-fips, dex, blob-csi-fips,...

CVE-2026-41569

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin...

CVE-2026-47201

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed...

CVE-2026-49448

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1...

BIT-AUTHENTIK-2026-49448 authentik: SourceStage bypass via empty POST

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1...

BIT-AUTHENTIK-2026-47201 authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed...

BIT-AUTHENTIK-2026-41569 authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin...

CVE-2026-42849

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE Simple Flow Executor in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issu...

CVE-2026-49443

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, an...

CVE-2026-49448

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1...

CVE-2026-41569

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin...