CVE-2026-49448

critical · 9.8

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

9.8

CVSS

0.4%

EPSS (exploit prob.)

35th

EPSS percentile

2026-06-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
goauthentik	authentik	< 2025.12.6
goauthentik	authentik	>= 2026.2.0, < 2026.2.4
goauthentik	authentik	>= 2026.5.0, < 2026.5.1

Check a specific version with /api/v1/cve/match.

References

https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8
https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-49448