CVE-2026-47201

A privilege escalation vulnerability in Authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries.

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group.

authentik before versions 2026.2.6 and 2026.5.5 contains a vulnerability in SAML Source configuration with USERNAME_LINK or EMAIL_LINK user-matching mode. An attacker can inject an XML comment into NameID, leading to account takeover.

Vulnerability in authentik (identity provider) prior to versions 2025.12.6, 2026.2.4, and 2026.5.1 allows bypassing the Source stage by sending an empty POST request.

XSS vulnerability in the AutosubmitStage component in authentik (open-source identity provider) prior to versions 2025.12.5 and 2026.2.3, allowing an attacker to inject malicious scripts.

authentik before versions 2026.2.6 and 2026.5.5 returns every configured Remote Access Control endpoint to any authenticated user regardless of application access, and the response includes connection settings that may contain stored credentials. Any authenticated user can read all endpoints with host and credentials and open connections to endpoints belonging to other applications, exposing credentials for managed RDP, SSH, and VNC targets and granting interactive access to unauthorized systems.

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

authentik before versions 2026.2.6 and 2026.5.5 in enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. An attacker who can reach such a stage can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed.

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection and an account in one of the configured sources can log into any account.

In authentik before version 2026.2.3, the WS-Federation provider validates the wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker can craft a login link with a wreply on a different origin that passes the check, causing the login response to be sent to attacker-controlled infrastructure.