What is the CVSS score of CVE-2026-25227?

CVE-2026-25227 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Authentik are affected by CVE-2026-25227?

A critical vulnerability (CVSS 9.1) in authentik identity provider poses an immediate risk to authentication and access control systems organization-wide.. A patch is available.

How to fix or mitigate CVE-2026-25227?

Within 24 hours: Inventory all authentik instances and notify stakeholders of patch availability; assess current version against vulnerability. Within 7 days: Apply available patch to all authentik deployments in production and non-production environments; validate functionality post-patch. Within 30 days: Complete security testing, review access logs for suspicious authentication activity, and document patch deployment completion.

Authentik CVE-2026-25227

CRITICAL

Code Injection (CWE-94)

2026-02-12 security-advisories@github.com

RCE Code Injection Authentik

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

Patch released

Feb 19, 2026 - 15:25 nvd

Patch available

CVE Published

Feb 12, 2026 - 20:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

AnalysisAI

Code injection in authentik identity provider from 2021.3.1 through multiple versions. Users with delegated permissions can inject code. Patch available.