authentik
2026.8.5The authentication glue you need.
- Maintenance
- Active1323 commits in 3 months · bus factor 1
- License
- OtherUnknown
- Security
- 30 advisories3 critical, 19 high, 8 medium
- Supported versions
- 2 lines supportednewest 2026.8 · oldest 2026.5 · 10 ended
26.4k stars · 2.1k forks · 941 open issues · last release 25 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 3 critical, 19 high, 8 medium. Check the patched version against the one you run.
- highCVE-2026-94613Sep 9, 2026Denial of Service via Malformed SAML Messages
- Affected
- <= 2026.8.1; <= 2026.5.6; <= 2026.2.6
- Patched in
- 2026.8.2; 2026.5.7; 2026.2.7
- highCVE-2026-94611Sep 9, 2026Certain stored credentials readable with view permission alone
- Affected
- <= 2026.2.6; <= 2026.5.6; <= 2026.8.1
- Patched in
- 2026.2.7; 2026.5.7; 2026.8.2
- highCVE-2026-94612Sep 9, 2026Authentication bypass in SAML Sources via assertion confusion and replay
- Affected
- <= 2026.2.6; <= 2026.5.6; <= 2026.8.1
- Patched in
- 2026.2.7; 2026.5.7; 2026.8.2
- highCVE-2026-94609Sep 9, 2026Privilege escalation via delegated group and user management
- Affected
- <= 2026.5.6; <= 2026.2.6; <= 2026.8.1
- Patched in
- 2026.5.7; 2026.2.7; 2026.8.2
- highCVE-2026-94606Sep 9, 2026MFA bypass via recipient override in the email authenticator
- Affected
- <= 2026.8.1; <= 2026.5.6; <= 2026.2.6
- Patched in
- 2026.8.2; 2026.5.7; 2026.2.7
- mediumGHSA-hmrg-vpp4-gj88Jul 15, 2026Broken access control in Shared Signals Framework stream management
- Affected
- <= 2026.5.4; <= 2026.2.5
- Patched in
- 2026.5.5; 2026.2.6
- highCVE-2026-61574Jul 15, 2026RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries
- Affected
- <= 2026.5.4; <= 2026.2.5
- Patched in
- 2026.5.5; 2026.2.6
- highCVE-2026-57580Jul 15, 2026Account Takeover via SAML NameID Comment Truncation
- Affected
- <= 2026.5.4; <= 2026.2.5
- Patched in
- 2026.5.5; 2026.2.6
- highCVE-2026-54730Jul 15, 2026Google Chrome device trust stages can be bypassed
- Affected
- <= 2026.2.5; <= 2026.5.4
- Patched in
- 2026.2.6; 2026.5.5
- mediumCVE-2026-55106Jul 15, 2026LDAP Source debug endpoint accessible without authorization
- Affected
- <= 2026.2.5; <= 2026.5.4
- Patched in
- 2026.2.6; 2026.5.5
- highCVE-2026-49443May 28, 2026`UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- Affected
- <=2025.12.5; <=2026.2.3; <=2026.5.0
- Patched in
- 2025.12.6; 2026.2.4; 2026.5.1
- criticalCVE-2026-49448May 28, 2026SourceStage bypass via empty POST
- Affected
- <=2025.12.5; <=2026.2.3; <=2026.5.0
- Patched in
- 2025.12.6; 2026.2.4; 2026.5.1
- highCVE-2026-47201May 28, 2026XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
- Affected
- <= 2025.12.5; <= 2026.2.3; <= 2026.5.0
- Patched in
- 2025.12.6; 2026.2.4; 2026.5.1
- mediumCVE-2026-41569May 12, 2026WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- Affected
- <= 2026.2.2
- Patched in
- 2026.2.3
- criticalCVE-2026-42849May 12, 2026Reflected XSS in SFE
- Affected
- <= 2026.2.2; <= 2025.12.4
- Patched in
- 2026.2.3; 2025.12.5
- highCVE-2026-40172May 12, 2026Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- Affected
- <= 2025.12.4; <= 2026.2.2
- Patched in
- 2025.12.5; 2026.2.3
- highGHSA-3wf5-rj6w-7527May 12, 2026OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
- Affected
- <= 2026.2.2; <= 2025.12.4
- Patched in
- 2026.2.3; 2025.12.5
- mediumCVE-2026-41577May 12, 2026SAML source does not validate Conditions, timing, or audience on assertions
- Affected
- <= 2025.2.4
- highCVE-2026-40166May 12, 2026Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- Affected
- <= 2026.2.2; <= 2025.12.4
- Patched in
- 2026.2.3; 2025.12.5
- highGHSA-5wcc-hf24-rf5hMay 12, 2026Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
- Affected
- <= 2026.2.2; <= 2025.12.4
- Patched in
- 2026.2.3; 2025.12.5
- highCVE-2026-40165May 12, 2026SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- Affected
- <= 2026.2.2; <= 2025.12.4
- Patched in
- 2026.2.3; 2025.12.5
- criticalCVE-2026-25227Feb 12, 2026Authenticated Remote Code Execution via Policy/Property Mapping test endpoint
- Affected
- >= 2021.3.1, < 2025.8.6; >= 2021.3.1, < 2025.10.4; >= 2021.3.1, < 2025.12.4
- Patched in
- 2025.8.6; 2025.10.4; 2025.12.4
- highCVE-2026-25748Feb 12, 2026Forward authentication bypass with malformed session cookie on Traefik and Caddy
- Affected
- <= 2025.10.3; <= 2025.12.3
- Patched in
- 2025.10.4; 2025.12.4
- highCVE-2026-25922Feb 12, 2026Signature Verification bypass in SAML Source Assertion
- Affected
- <= 2025.8.5; <= 2025.10.3; <= 2025.12.3
- Patched in
- 2025.8.6; 2025.10.4; 2025.12.4
- mediumCVE-2025-64708Nov 19, 2025Invitation expiry is delayed by at least 5 minutes
- Affected
- <= 2025.10.1; <= 2025.8.4
- Patched in
- 2025.10.2; 2025.8.5
- mediumCVE-2025-64521Nov 19, 2025Deactivated service account can authenticate to OAuth
- Affected
- <= 2025.10.1; <= 2025.8.4
- Patched in
- 2025.10.2; 2025.8.5
- highCVE-2025-53942Jul 22, 2025Insufficient check for account active status when authenticating with OAuth/SAML Sources
- Affected
- < 2025.6.4; < 2025.4.4
- Patched in
- 2025.6.4; 2025.4.4
- mediumCVE-2025-52553Jun 27, 2025Insufficient Session verification for Remote Access Control endpoint access
- Affected
- < 2025.6.3; < 2025.4.3
- Patched in
- 2025.6.3; 2025.4.3
- highCVE-2025-29928Mar 28, 2025Deletion of sessions did not revoke sessions when using database session storage
- Affected
- < 2025.2.3; < 2024.12.4
- Patched in
- 2025.2.3; 2024.12.4
- mediumCVE-2024-52287Nov 21, 2024Insufficient validation of OAuth scopes for client_credentials and device_code grants
- Affected
- < 2024.10.3; < 2024.8.5
- Patched in
- 2024.10.3; 2024.8.5