agentprime: authentikEvery new CVE for authentik.https://agentprime.io/CVE-2026-94606: authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStagehttps://agentprime.io/advisories/CVE-2026-94606/https://agentprime.io/advisories/CVE-2026-94606/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:23:30 GMTCVECVE-2026-94609: authentik: Privilege Escalation to Superuser via Group Hierarchyhttps://agentprime.io/advisories/CVE-2026-94609/https://agentprime.io/advisories/CVE-2026-94609/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:20:45 GMTCVECVE-2026-94611: authentik: Stored credentials are readable with view permission alonehttps://agentprime.io/advisories/CVE-2026-94611/https://agentprime.io/advisories/CVE-2026-94611/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:18:46 GMTCVECVE-2026-94612: authentik: Authentication bypass via assertion confusion in SAML sourceshttps://agentprime.io/advisories/CVE-2026-94612/https://agentprime.io/advisories/CVE-2026-94612/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:16:33 GMTCVECVE-2026-94613: authentik: Denial of Service via Document Type Declarations in SAML Messageshttps://agentprime.io/advisories/CVE-2026-94613/https://agentprime.io/advisories/CVE-2026-94613/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 16:13:17 GMTCVECVE-2026-57580: authentik: Account Takeover via SAML NameID Comment Truncationhttps://agentprime.io/advisories/CVE-2026-57580/https://agentprime.io/advisories/CVE-2026-57580/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 17:00:19 GMTCVEcriticalCVE-2026-55106: authentik: Unauthenticated LDAP directory data disclosurehttps://agentprime.io/advisories/CVE-2026-55106/https://agentprime.io/advisories/CVE-2026-55106/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 16:59:12 GMTCVECVE-2026-61574: authentik RAC: access any endpoint via an unrelated applicationhttps://agentprime.io/advisories/CVE-2026-61574/https://agentprime.io/advisories/CVE-2026-61574/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 16:57:47 GMTCVECVE-2026-54730: authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageViewhttps://agentprime.io/advisories/CVE-2026-54730/https://agentprime.io/advisories/CVE-2026-54730/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 16:55:29 GMTCVECVE-2026-72537: Authentik Security authentik - Privilege Escalationhttps://agentprime.io/advisories/CVE-2026-72537/https://agentprime.io/advisories/CVE-2026-72537/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 11:07:22 GMTCVECVE-2026-72534: Authentik Security authentik - Privilege Escalationhttps://agentprime.io/advisories/CVE-2026-72534/https://agentprime.io/advisories/CVE-2026-72534/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 11:06:44 GMTCVECVE-2026-49448: authentik: SourceStage bypass via empty POSThttps://agentprime.io/advisories/CVE-2026-49448/https://agentprime.io/advisories/CVE-2026-49448/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 20:31:20 GMTCVEcriticalCVE-2026-49443: authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the APIhttps://agentprime.io/advisories/CVE-2026-49443/https://agentprime.io/advisories/CVE-2026-49443/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 20:31:09 GMTCVECVE-2026-42849: authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeoverhttps://agentprime.io/advisories/CVE-2026-42849/https://agentprime.io/advisories/CVE-2026-42849/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 20:30:43 GMTCVEcriticalCVE-2026-41569: authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpointshttps://agentprime.io/advisories/CVE-2026-41569/https://agentprime.io/advisories/CVE-2026-41569/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 20:30:21 GMTCVECVE-2026-41577: authentik: SAML source does not validate Conditions, timing, or audience on assertionshttps://agentprime.io/advisories/CVE-2026-41577/https://agentprime.io/advisories/CVE-2026-41577/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 17:12:26 GMTCVECVE-2026-40172: authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuserhttps://agentprime.io/advisories/CVE-2026-40172/https://agentprime.io/advisories/CVE-2026-40172/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 19:00:52 GMTCVECVE-2026-40166: authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/https://agentprime.io/advisories/CVE-2026-40166/https://agentprime.io/advisories/CVE-2026-40166/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 18:52:46 GMTCVECVE-2026-40165: authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncationhttps://agentprime.io/advisories/CVE-2026-40165/https://agentprime.io/advisories/CVE-2026-40165/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 20 May 2026 23:35:18 GMTCVECVE-2026-25922: authentik has a Signature Verification Bypass via SAML Assertion Wrappinghttps://agentprime.io/advisories/CVE-2026-25922/https://agentprime.io/advisories/CVE-2026-25922/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Feb 2026 19:38:16 GMTCVECVE-2026-25748: authentik has a forward authentication bypass with broken cookiehttps://agentprime.io/advisories/CVE-2026-25748/https://agentprime.io/advisories/CVE-2026-25748/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Feb 2026 19:36:45 GMTCVECVE-2026-25227: authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpointhttps://agentprime.io/advisories/CVE-2026-25227/https://agentprime.io/advisories/CVE-2026-25227/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Feb 2026 19:25:26 GMTCVEcriticalCVE-2025-52553: authentik has Insufficient Session verification for Remote Access Control endpoint accesshttps://agentprime.io/advisories/CVE-2025-52553/https://agentprime.io/advisories/CVE-2025-52553/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Jun 2025 15:03:13 GMTCVECVE-2025-29928: authentik's deletion of sessions did not revoke sessions when using database session storagehttps://agentprime.io/advisories/CVE-2025-29928/https://agentprime.io/advisories/CVE-2025-29928/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Mar 2025 14:42:39 GMTCVECVE-2024-11623: Stored XSS in authentikhttps://agentprime.io/advisories/CVE-2024-11623/https://agentprime.io/advisories/CVE-2024-11623/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 04 Feb 2025 13:34:11 GMTCVECVE-2024-52287: authentik performs insufficient validation of OAuth scopeshttps://agentprime.io/advisories/CVE-2024-52287/https://agentprime.io/advisories/CVE-2024-52287/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 21 Nov 2024 17:23:40 GMTCVECVE-2024-52289: authentik has an insecure default configuration for OAuth2 Redirect URIshttps://agentprime.io/advisories/CVE-2024-52289/https://agentprime.io/advisories/CVE-2024-52289/CVSS 7.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 21 Nov 2024 17:18:41 GMTCVECVE-2024-52307: authentik allows a timing attack due to missing constant time comparison for metrics viewhttps://agentprime.io/advisories/CVE-2024-52307/https://agentprime.io/advisories/CVE-2024-52307/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 21 Nov 2024 17:14:51 GMTCVECVE-2024-47077: authentik cross-provider token validation problemshttps://agentprime.io/advisories/CVE-2024-47077/https://agentprime.io/advisories/CVE-2024-47077/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Sep 2024 15:26:20 GMTCVECVE-2024-47070: authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP headerhttps://agentprime.io/advisories/CVE-2024-47070/https://agentprime.io/advisories/CVE-2024-47070/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Sep 2024 15:18:03 GMTCVEcriticalCVE-2024-38371: Insufficient access control for OAuth2 Device Code flow in authentikhttps://agentprime.io/advisories/CVE-2024-38371/https://agentprime.io/advisories/CVE-2024-38371/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Jun 2024 17:58:48 GMTCVECVE-2024-37905: Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentikhttps://agentprime.io/advisories/CVE-2024-37905/https://agentprime.io/advisories/CVE-2024-37905/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Jun 2024 17:09:24 GMTCVECVE-2024-21637: XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Modehttps://agentprime.io/advisories/CVE-2024-21637/https://agentprime.io/advisories/CVE-2024-21637/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Jan 2024 05:49:44 GMTCVECVE-2023-48228: OAuth2: PKCE can be fully circumventedhttps://agentprime.io/advisories/CVE-2023-48228/https://agentprime.io/advisories/CVE-2023-48228/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Nov 2023 20:48:32 GMTCVECVE-2023-46249: authentik potential installation takeover when default admin user is deletedhttps://agentprime.io/advisories/CVE-2023-46249/https://agentprime.io/advisories/CVE-2023-46249/CVSS 9.7 (Critical). Critical: CVSS score 9.7: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Oct 2023 15:20:35 GMTCVEcriticalCVE-2023-36456: Authentik lacks Proxy IP headers validationhttps://agentprime.io/advisories/CVE-2023-36456/https://agentprime.io/advisories/CVE-2023-36456/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Jul 2023 18:24:03 GMTCVECVE-2023-26481: Insufficient user check in FlowTokens by Email stagehttps://agentprime.io/advisories/CVE-2023-26481/https://agentprime.io/advisories/CVE-2023-26481/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 04 Mar 2023 00:30:16 GMTCVEcriticalCVE-2022-46172: authentik allows existing authenticated users to create arbitrary accountshttps://agentprime.io/advisories/CVE-2022-46172/https://agentprime.io/advisories/CVE-2022-46172/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Dec 2022 06:16:21 GMTCVECVE-2022-23555: authentik vulnerable to Improper Authentication via invitation URL token reusehttps://agentprime.io/advisories/CVE-2022-23555/https://agentprime.io/advisories/CVE-2022-23555/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Dec 2022 00:12:35 GMTCVEcriticalCVE-2022-46145: authentik vulnerable to unauthorized user creation and potential account takeoverhttps://agentprime.io/advisories/CVE-2022-46145/https://agentprime.io/advisories/CVE-2022-46145/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Dec 2022 17:12:42 GMTCVE