by Kastro
Paper/Archive/CVE-2026-49448

CVE-2026-49448

goauthentik authentik — authentik: SourceStage bypass via empty POST

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.8.348 × 207.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

Affected

ProductAffectedFixed inSource
authentik< 2025.12.6–CNA
authentik< 2026.2.4–CNA
authentik< 2026.5.1–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8