# cve.now: Goauthentik

The newest entries naming Goauthentik as an affected vendor (up to 200), of 45 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-94606](https://cve.now/CVE-2026-94606.md): authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage (CVSS 8.9)
- [CVE-2026-94609](https://cve.now/CVE-2026-94609.md): authentik: Privilege Escalation to Superuser via Group Hierarchy (CVSS 8.8)
- [CVE-2026-94611](https://cve.now/CVE-2026-94611.md): authentik: Stored credentials are readable with view permission alone (CVSS 8.1)
- [CVE-2026-94612](https://cve.now/CVE-2026-94612.md): authentik: Authentication bypass via assertion confusion in SAML sources (CVSS 7.4)
- [CVE-2026-94613](https://cve.now/CVE-2026-94613.md): authentik: Denial of Service via Document Type Declarations in SAML Messages (CVSS 7.5)
- [CVE-2026-57580](https://cve.now/CVE-2026-57580.md): authentik: Account Takeover via SAML NameID Comment Truncation (CVSS 9.4)
- [CVE-2026-55106](https://cve.now/CVE-2026-55106.md): authentik: Unauthenticated LDAP directory data disclosure (CVSS 5.3)
- [CVE-2026-61574](https://cve.now/CVE-2026-61574.md): authentik RAC: access any endpoint via an unrelated application (CVSS 8.8)
- [CVE-2026-54730](https://cve.now/CVE-2026-54730.md): authentik: Authentication Flow Bypass via Unguarded challenge\_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView (CVSS 8.6)
- [CVE-2026-49448](https://cve.now/CVE-2026-49448.md): authentik: SourceStage bypass via empty POST (CVSS 9.8)
- [CVE-2026-49443](https://cve.now/CVE-2026-49443.md): authentik: \`UserSourceConnection.user\` and \`GroupSourceConnection.group\` are changeable through the API (CVSS 8.8)
- [CVE-2026-47201](https://cve.now/CVE-2026-47201.md): authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user (CVSS 8.5)
- [CVE-2026-42849](https://cve.now/CVE-2026-42849.md): authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover (CVSS 9.3)
- [CVE-2026-41569](https://cve.now/CVE-2026-41569.md): authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints (CVSS 6.9)
- [CVE-2026-41577](https://cve.now/CVE-2026-41577.md): authentik: SAML source does not validate Conditions, timing, or audience on assertions (CVSS 6.9)
- [CVE-2026-40172](https://cve.now/CVE-2026-40172.md): authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable\_group\_superuser (CVSS 8.1)
- [CVE-2026-40166](https://cve.now/CVE-2026-40166.md): authentik: Non-admin user can retrieve confidential OAuth client\_secret via /api/v3/oauth2/access\_tokens/ (CVSS 7.1)
- [CVE-2026-40165](https://cve.now/CVE-2026-40165.md): authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation (CVSS 8.7)
- [CVE-2026-25922](https://cve.now/CVE-2026-25922.md): authentik has a Signature Verification Bypass via SAML Assertion Wrapping (CVSS 8.8)
- [CVE-2026-25748](https://cve.now/CVE-2026-25748.md): authentik has a forward authentication bypass with broken cookie (CVSS 8.6)
- [CVE-2026-25227](https://cve.now/CVE-2026-25227.md): authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint (CVSS 9.1)
- [CVE-2025-64708](https://cve.now/CVE-2025-64708.md): authentik invitation expiry is delayed by at least 5 minutes (CVSS 5.8)
- [CVE-2025-64521](https://cve.now/CVE-2025-64521.md): authentik deactivated service accounts can authenticate to OAuth (CVSS 4.8)
- [CVE-2025-53942](https://cve.now/CVE-2025-53942.md): authentik has an insufficient check for account active status during OAuth/SAML authentication (CVSS 7.1)
- [CVE-2025-52553](https://cve.now/CVE-2025-52553.md): authentik has Insufficient Session verification for Remote Access Control endpoint access (CVSS 5.5)
- [CVE-2025-29928](https://cve.now/CVE-2025-29928.md): authentik's deletion of sessions did not revoke sessions when using database session storage (CVSS 8.0)
- [CVE-2024-11623](https://cve.now/CVE-2024-11623.md): Stored XSS in authentik (CVSS 4.8)
- [CVE-2024-52287](https://cve.now/CVE-2024-52287.md): authentik performs insufficient validation of OAuth scopes (CVSS 6.4)
- [CVE-2024-52289](https://cve.now/CVE-2024-52289.md): authentik has an insecure default configuration for OAuth2 Redirect URIs (CVSS 7.9)
- [CVE-2024-52307](https://cve.now/CVE-2024-52307.md): authentik allows a timing attack due to missing constant time comparison for metrics view (CVSS 6.3)
- [CVE-2024-47077](https://cve.now/CVE-2024-47077.md): authentik cross-provider token validation problems (CVSS 6.5)
- [CVE-2024-47070](https://cve.now/CVE-2024-47070.md): authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header (CVSS 9.1)
- [CVE-2024-42490](https://cve.now/CVE-2024-42490.md): authentik has Insufficient Authorization for several API endpoints (CVSS 7.5)
- [CVE-2024-38371](https://cve.now/CVE-2024-38371.md): Insufficient access control for OAuth2 Device Code flow in authentik (CVSS 8.6)
- [CVE-2024-37905](https://cve.now/CVE-2024-37905.md): Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik (CVSS 8.8)
- [CVE-2024-23647](https://cve.now/CVE-2024-23647.md): PKCE downgrade attack in Authentik (CVSS 6.5)
- [CVE-2024-21637](https://cve.now/CVE-2024-21637.md): XSS in Authentik via JavaScript-URI as Redirect URI and form\_post Response Mode (CVSS 7.7)
- [CVE-2023-48228](https://cve.now/CVE-2023-48228.md): OAuth2: PKCE can be fully circumvented (CVSS 7.5)
- [CVE-2023-46249](https://cve.now/CVE-2023-46249.md): authentik potential installation takeover when default admin user is deleted (CVSS 9.7)
- [CVE-2023-39522](https://cve.now/CVE-2023-39522.md): Username enumeration attack in goauthentik (CVSS 5.3)
- [CVE-2023-36456](https://cve.now/CVE-2023-36456.md): Authentik lacks Proxy IP headers validation (CVSS 8.3)
- [CVE-2023-26481](https://cve.now/CVE-2023-26481.md): Insufficient user check in FlowTokens by Email stage (CVSS 9.1)
- [CVE-2022-46172](https://cve.now/CVE-2022-46172.md): authentik allows existing authenticated users to create arbitrary accounts (CVSS 6.4)
- [CVE-2022-23555](https://cve.now/CVE-2022-23555.md): authentik vulnerable to Improper Authentication via invitation URL token reuse (CVSS 9.4)
- [CVE-2022-46145](https://cve.now/CVE-2022-46145.md): authentik vulnerable to unauthorized user creation and potential account takeover (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/goauthentik
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.