Goauthentik vulnerabilities
45 CVEs and advisories name Goauthentik as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-94606authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage
- CVE-2026-94609authentik: Privilege Escalation to Superuser via Group Hierarchy
- CVE-2026-94611authentik: Stored credentials are readable with view permission alone
- CVE-2026-94612authentik: Authentication bypass via assertion confusion in SAML sources
- CVE-2026-94613authentik: Denial of Service via Document Type Declarations in SAML Messages
- CVE-2026-57580authentik: Account Takeover via SAML NameID Comment Truncation
- CVE-2026-55106authentik: Unauthenticated LDAP directory data disclosure
- CVE-2026-61574authentik RAC: access any endpoint via an unrelated application
- CVE-2026-54730authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView
- CVE-2026-49448authentik: SourceStage bypass via empty POST
- CVE-2026-49443authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- CVE-2026-47201authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
- CVE-2026-42849authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
- CVE-2026-41569authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- CVE-2026-41577authentik: SAML source does not validate Conditions, timing, or audience on assertions
- CVE-2026-40172authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- CVE-2026-40166authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- CVE-2026-40165authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- CVE-2026-25922authentik has a Signature Verification Bypass via SAML Assertion Wrapping
- CVE-2026-25748authentik has a forward authentication bypass with broken cookie
- CVE-2026-25227authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint
- CVE-2025-64708authentik invitation expiry is delayed by at least 5 minutes
- CVE-2025-64521authentik deactivated service accounts can authenticate to OAuth
- CVE-2025-53942authentik has an insufficient check for account active status during OAuth/SAML authentication
- CVE-2025-52553authentik has Insufficient Session verification for Remote Access Control endpoint access
- CVE-2025-29928authentik's deletion of sessions did not revoke sessions when using database session storage
- CVE-2024-11623Stored XSS in authentik
- CVE-2024-52287authentik performs insufficient validation of OAuth scopes
- CVE-2024-52289authentik has an insecure default configuration for OAuth2 Redirect URIs
- CVE-2024-52307authentik allows a timing attack due to missing constant time comparison for metrics view