# authentik. Every CVE that names authentik among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage](https://agentprime.io/advisories/CVE-2026-94606.md) `CVE-2026-94606` · CVE record: goauthentik authentik · CVSS 8.9 High · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass, CWE-807 - [authentik: Privilege Escalation to Superuser via Group Hierarchy](https://agentprime.io/advisories/CVE-2026-94609.md) `CVE-2026-94609` · CVE record: goauthentik authentik · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation, Broken access control - [authentik: Stored credentials are readable with view permission alone](https://agentprime.io/advisories/CVE-2026-94611.md) `CVE-2026-94611` · CVE record: goauthentik authentik · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Hard-coded credentials - [authentik: Authentication bypass via assertion confusion in SAML sources](https://agentprime.io/advisories/CVE-2026-94612.md) `CVE-2026-94612` · CVE record: goauthentik authentik · CVSS 7.4 High · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass, CWE-345 - [authentik: Denial of Service via Document Type Declarations in SAML Messages](https://agentprime.io/advisories/CVE-2026-94613.md) `CVE-2026-94613` · CVE record: goauthentik authentik · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service - [authentik: Account Takeover via SAML NameID Comment Truncation](https://agentprime.io/advisories/CVE-2026-57580.md) `CVE-2026-57580` · CVE record: goauthentik authentik · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-436 - [authentik: Unauthenticated LDAP directory data disclosure](https://agentprime.io/advisories/CVE-2026-55106.md) `CVE-2026-55106` · CVE record: goauthentik authentik · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [authentik RAC: access any endpoint via an unrelated application](https://agentprime.io/advisories/CVE-2026-61574.md) `CVE-2026-61574` · CVE record: goauthentik authentik · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView](https://agentprime.io/advisories/CVE-2026-54730.md) `CVE-2026-54730` · CVE record: goauthentik authentik · CVSS 8.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control, CWE-807 - [Authentik Security authentik - Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72537.md) `CVE-2026-72537` · CVE record: Authentik Security authentik · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation - [Authentik Security authentik - Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72534.md) `CVE-2026-72534` · CVE record: Authentik Security authentik · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation - [authentik: SourceStage bypass via empty POST](https://agentprime.io/advisories/CVE-2026-49448.md) `CVE-2026-49448` · CVE record: goauthentik authentik · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2026 · Tags: Authentication bypass - [authentik: \`UserSourceConnection.user\` and \`GroupSourceConnection.group\` are changeable through the API](https://agentprime.io/advisories/CVE-2026-49443.md) `CVE-2026-49443` · CVE record: goauthentik authentik · CVSS 8.8 High · Not analysed yet · Published 2 Jun 2026 · Tags: Authentication bypass - [authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover](https://agentprime.io/advisories/CVE-2026-42849.md) `CVE-2026-42849` · CVE record: goauthentik authentik · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2026 · Tags: Cross-site scripting (XSS) - [authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints](https://agentprime.io/advisories/CVE-2026-41569.md) `CVE-2026-41569` · CVE record: goauthentik authentik · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Open redirect - [authentik: SAML source does not validate Conditions, timing, or audience on assertions](https://agentprime.io/advisories/CVE-2026-41577.md) `CVE-2026-41577` · CVE record: goauthentik authentik · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-345 - [authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser](https://agentprime.io/advisories/CVE-2026-40172.md) `CVE-2026-40172` · CVE record: goauthentik authentik · CVSS 8.1 High · Not analysed yet · Published 22 May 2026 · Tags: Privilege escalation - [authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/](https://agentprime.io/advisories/CVE-2026-40166.md) `CVE-2026-40166` · CVE record: goauthentik authentik · CVSS 7.1 High · Not analysed yet · Published 22 May 2026 · Tags: Information disclosure, Broken access control - [authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation](https://agentprime.io/advisories/CVE-2026-40165.md) `CVE-2026-40165` · CVE record: goauthentik authentik · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: Other injection, Authentication bypass, CWE-436 - [authentik has a Signature Verification Bypass via SAML Assertion Wrapping](https://agentprime.io/advisories/CVE-2026-25922.md) `CVE-2026-25922` · CVE record: goauthentik authentik · CVSS 8.8 High · Not analysed yet · Published 12 Feb 2026 · Tags: Authentication bypass, Weak cryptography or TLS - [authentik has a forward authentication bypass with broken cookie](https://agentprime.io/advisories/CVE-2026-25748.md) `CVE-2026-25748` · CVE record: goauthentik authentik · CVSS 8.6 High · Not analysed yet · Published 12 Feb 2026 · Tags: Authentication bypass - [authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint](https://agentprime.io/advisories/CVE-2026-25227.md) `CVE-2026-25227` · CVE record: goauthentik authentik · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Feb 2026 · Tags: Code injection - [authentik has Insufficient Session verification for Remote Access Control endpoint access](https://agentprime.io/advisories/CVE-2025-52553.md) `CVE-2025-52553` · CVE record: goauthentik authentik · CVSS 5.5 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: Authentication bypass - [authentik's deletion of sessions did not revoke sessions when using database session storage](https://agentprime.io/advisories/CVE-2025-29928.md) `CVE-2025-29928` · CVE record: goauthentik authentik · CVSS 8.0 High · Not analysed yet · Published 28 Mar 2025 · Tags: Authentication bypass - [Stored XSS in authentik](https://agentprime.io/advisories/CVE-2024-11623.md) `CVE-2024-11623` · CVE record: goauthentik authentik · CVSS 4.8 Medium · Not analysed yet · Published 4 Feb 2025 · Tags: Cross-site scripting (XSS) - [authentik performs insufficient validation of OAuth scopes](https://agentprime.io/advisories/CVE-2024-52287.md) `CVE-2024-52287` · CVE record: goauthentik authentik · CVSS 6.4 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: Broken access control - [authentik has an insecure default configuration for OAuth2 Redirect URIs](https://agentprime.io/advisories/CVE-2024-52289.md) `CVE-2024-52289` · CVE record: goauthentik authentik · CVSS 7.9 High · Not analysed yet · Published 21 Nov 2024 · Tags: CWE-185 - [authentik allows a timing attack due to missing constant time comparison for metrics view](https://agentprime.io/advisories/CVE-2024-52307.md) `CVE-2024-52307` · CVE record: goauthentik authentik · CVSS 6.3 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: CWE-208 - [authentik cross-provider token validation problems](https://agentprime.io/advisories/CVE-2024-47077.md) `CVE-2024-47077` · CVE record: goauthentik authentik · CVSS 6.5 Medium · Not analysed yet · Published 27 Sept 2024 · Tags: Broken access control - [authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header](https://agentprime.io/advisories/CVE-2024-47070.md) `CVE-2024-47070` · CVE record: goauthentik authentik · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2024 · Tags: Authentication bypass - [Insufficient access control for OAuth2 Device Code flow in authentik](https://agentprime.io/advisories/CVE-2024-38371.md) `CVE-2024-38371` · CVE record: goauthentik authentik · CVSS 8.6 High · Not analysed yet · Published 28 Jun 2024 · Tags: Broken access control - [Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik](https://agentprime.io/advisories/CVE-2024-37905.md) `CVE-2024-37905` · CVE record: goauthentik authentik · CVSS 8.8 High · Not analysed yet · Published 28 Jun 2024 · Tags: Broken access control - [XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode](https://agentprime.io/advisories/CVE-2024-21637.md) `CVE-2024-21637` · CVE record: goauthentik authentik · CVSS 7.7 High · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site scripting (XSS) - [OAuth2: PKCE can be fully circumvented](https://agentprime.io/advisories/CVE-2023-48228.md) `CVE-2023-48228` · CVE record: goauthentik authentik · CVSS 7.5 High · Not analysed yet · Published 21 Nov 2023 · Tags: Authentication bypass - [authentik potential installation takeover when default admin user is deleted](https://agentprime.io/advisories/CVE-2023-46249.md) `CVE-2023-46249` · CVE record: goauthentik authentik · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2023 · Tags: Authentication bypass - [Authentik lacks Proxy IP headers validation](https://agentprime.io/advisories/CVE-2023-36456.md) `CVE-2023-36456` · CVE record: goauthentik authentik · CVSS 8.3 High · Not analysed yet · Published 6 Jul 2023 · Tags: CWE-436 - [Insufficient user check in FlowTokens by Email stage](https://agentprime.io/advisories/CVE-2023-26481.md) `CVE-2023-26481` · CVE record: goauthentik authentik · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Mar 2023 · Tags: CWE-345 - [authentik allows existing authenticated users to create arbitrary accounts](https://agentprime.io/advisories/CVE-2022-46172.md) `CVE-2022-46172` · CVE record: goauthentik authentik · CVSS 6.4 Medium · Not analysed yet · Published 28 Dec 2022 · Tags: Privilege escalation, Authentication bypass - [authentik vulnerable to Improper Authentication via invitation URL token reuse](https://agentprime.io/advisories/CVE-2022-23555.md) `CVE-2022-23555` · CVE record: goauthentik authentik · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Dec 2022 · Tags: Authentication bypass - [authentik vulnerable to unauthorized user creation and potential account takeover](https://agentprime.io/advisories/CVE-2022-46145.md) `CVE-2022-46145` · CVE record: goauthentik authentik · CVSS 8.1 High · Not analysed yet · Published 2 Dec 2022 · Tags: Authentication bypass ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .