Approved changes feed: RSS · Atom
cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Goauthentik (027904a7-5f71-590c-b8aa-9ecf436a12d9) |
|---|---|
| Product | Authentik (e6eb77f4-1940-5cbb-aa5c-219537865ff2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/goauthentik/authentik |
purl2cpe | 2026-06-01 10:16:59.474920 |
pkg:golang/github.com/goauthentik/authentik |
purl2cpe | 2026-06-01 10:16:59.474922 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49448 |
vulnerable | 2026-06-08 08:05:12.450623 |
authentik: SourceStage bypass via empty POST
CRITICAL (9.8)
authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.
Published: 2026-06-02T20:31:20.323Z
Updated: 2026-06-03T12:46:25.064Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49443 |
vulnerable | 2026-06-08 08:05:12.450490 |
authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
HIGH (8.8)
authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.
Published: 2026-06-02T20:31:09.108Z
Updated: 2026-06-03T13:59:41.215Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-47201 |
vulnerable | 2026-06-08 08:05:12.187028 |
authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
HIGH (8.5)
authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user. This issue has been patched in versions 2025.12.5, 2026.2.3, and 2026.5.1.
Published: 2026-06-02T20:30:55.674Z
Updated: 2026-06-03T14:08:11.139Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42849 |
vulnerable | 2026-06-08 08:03:16.817880 |
authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
CRITICAL (9.3)
authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.
Published: 2026-06-02T20:30:43.839Z
Updated: 2026-06-03T19:05:26.760Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41577 |
vulnerable | 2026-06-08 08:03:15.585219 |
authentik: SAML source does not validate Conditions, timing, or audience on assertions
authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expired assertions and acceptance of assertions intended for other service providers. This issue has been patched in versions 2025.12.5 and 2026.2.3.
Published: 2026-06-02T17:12:26.690Z
Updated: 2026-06-03T13:18:23.260Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41569 |
vulnerable | 2026-06-08 08:03:15.569604 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40172 |
vulnerable | 2026-06-08 08:01:19.992415 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40166 |
vulnerable | 2026-06-08 08:01:19.981059 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40165 |
vulnerable | 2026-06-08 08:01:19.980729 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25922 |
vulnerable | 2026-06-08 07:53:20.607120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25748 |
vulnerable | 2026-06-08 07:53:20.286481 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25227 |
vulnerable | 2026-06-08 07:53:19.527042 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64708 |
vulnerable | 2026-06-08 07:39:20.184034 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64521 |
vulnerable | 2026-06-08 07:39:19.884489 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53942 |
vulnerable | 2026-06-08 07:31:15.968983 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-52553 |
vulnerable | 2026-06-08 07:31:11.815200 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29928 |
vulnerable | 2026-06-08 07:14:56.957790 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52307 |
vulnerable | 2026-06-08 06:52:14.760417 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52289 |
vulnerable | 2026-06-08 06:52:14.727456 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52287 |
vulnerable | 2026-06-08 06:52:14.725819 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47077 |
vulnerable | 2026-06-08 06:48:11.245306 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47070 |
vulnerable | 2026-06-08 06:48:11.233870 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-42490 |
vulnerable | 2026-06-08 06:45:46.561639 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38371 |
vulnerable | 2026-06-08 06:41:45.151069 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37905 |
vulnerable | 2026-06-08 06:39:48.234835 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23647 |
vulnerable | 2026-06-08 06:29:40.084467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-21637 |
vulnerable | 2026-06-08 06:27:36.264339 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11623 |
vulnerable | 2026-06-08 06:23:50.013370 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48228 |
vulnerable | 2026-06-08 06:14:26.331202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46249 |
vulnerable | 2026-06-08 06:12:44.490444 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39522 |
vulnerable | 2026-06-08 06:09:37.648709 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-36456 |
vulnerable | 2026-06-08 06:08:11.723543 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26481 |
vulnerable | 2026-06-08 05:57:39.784602 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46172 |
vulnerable | 2026-06-08 05:50:38.302678 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46145 |
vulnerable | 2026-06-08 05:50:38.225433 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23555 |
vulnerable | 2026-06-08 05:40:57.756108 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.