goauthentik authentik vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 20235
3. 202410
4. 20256
5. 202621

Newest CVEs

• CVE-2026-94606

  authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

  goauthentik · authentik

  High8.9
• CVE-2026-94609

  authentik: Privilege Escalation to Superuser via Group Hierarchy

  goauthentik · authentik

  High8.8
• CVE-2026-94611

  authentik: Stored credentials are readable with view permission alone

  goauthentik · authentik

  High8.1
• CVE-2026-94612

  authentik: Authentication bypass via assertion confusion in SAML sources

  goauthentik · authentik

  High7.4
• CVE-2026-94613

  authentik: Denial of Service via Document Type Declarations in SAML Messages

  goauthentik · authentik

  High7.5
• CVE-2026-57580

  authentik: Account Takeover via SAML NameID Comment Truncation

  goauthentik · authentik

  Critical9.4
• CVE-2026-55106

  authentik: Unauthenticated LDAP directory data disclosure

  goauthentik · authentik

  Medium5.3
• CVE-2026-61574

  authentik RAC: access any endpoint via an unrelated application

  goauthentik · authentik

  High8.8
• CVE-2026-54730

  authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView

  goauthentik · authentik

  High8.6
• CVE-2026-49448

  authentik: SourceStage bypass via empty POST

  goauthentik · authentik

  Critical9.8