authentik vulnerabilities

A privilege escalation vulnerability in Authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries.

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group.

authentik before versions 2026.2.6 and 2026.5.5 contains a vulnerability in SAML Source configuration with USERNAME_LINK or EMAIL_LINK user-matching mode. An attacker can inject an XML comment into NameID, leading to account takeover.

Vulnerability in authentik (identity provider) prior to versions 2025.12.6, 2026.2.4, and 2026.5.1 allows bypassing the Source stage by sending an empty POST request.

XSS vulnerability in the AutosubmitStage component in authentik (open-source identity provider) prior to versions 2025.12.5 and 2026.2.3, allowing an attacker to inject malicious scripts.

authentik before versions 2026.2.6 and 2026.5.5 returns every configured Remote Access Control endpoint to any authenticated user regardless of application access, and the response includes connection settings that may contain stored credentials. Any authenticated user can read all endpoints with host and credentials and open connections to endpoints belonging to other applications, exposing credentials for managed RDP, SSH, and VNC targets and granting interactive access to unauthorized systems.

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.

authentik before versions 2026.2.6 and 2026.5.5 in enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. An attacker who can reach such a stage can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed.

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection and an account in one of the configured sources can log into any account.

authentik, an open-source identity provider, prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, is vulnerable to XML Signature Wrapping in the SAML Source ACS endpoint when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user.

In authentik before version 2026.2.3, the WS-Federation provider validates the wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker can craft a login link with a wreply on a different origin that passes the check, causing the login response to be sent to attacker-controlled infrastructure.

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expired assertions and acceptance of assertions intended for other service providers.

In authentik prior to versions 2025.12.5 and 2026.2.3, the PATCH /api/v3/core/users/{pk}/ API allows a caller with change_user permission to assign arbitrary groups, including groups with is_superuser=True, without requiring enable_group_superuser, leading to privilege escalation.

In authentik prior to versions 2025.12.5 and 2026.2.3, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against. This occurs via the GET /api/v3/oauth2/access_tokens/ API, which returns a nested provider object containing client_id and client_secret for providers with client_type: confidential.

Vulnerability in authentik (open-source identity provider) in versions up to 2025.12.4 and 2026.2.0-rc1 through 2026.2.2. An attacker can bypass authentication via SAML NameID XML Comment Injection, allowing access to other accounts if the attacker has an account on the SAML source and can modify NameID.

In versions prior to 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, which may lead to IP address spoofing in logs and downstream applications. Only authentik setups directly accessible by users are susceptible to this vulnerability.