BIT-authentik-2026-49448

vendorUSosv

authentik: SourceStage bypass via empty POST

view advisory published 2026-06-05Licence: per source

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-49448US	—	0.40% (35th)	—	2026-06-02
authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been p…

references

External citations — patches, advisories, analysis.

https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-49448WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan