Unauthorised User Account Creation

authentik is vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create a new account. If a flow allows email password recovery, attackers can overwrite the email address of admin accounts and take over the account.