Authentik
CVE-2026-25748
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed cookie
-
ExploitSend to Proxy Provider endpoint
-
ExecutionBypass authentication check
-
ImpactAccess protected application without X-Authentik headers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | authentik Proxy Provider deployed with forward authentication using Traefik or Caddy as reverse proxy. No authentication required; exploitation succeeds against default configurations. |
| Impact | CVSS 8.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Authentik Proxy Provider allows authentication bypass through malformed cookies when deployed with Traefik or Caddy as a reverse proxy, enabling attackers to access protected applications by circumventing forward authentication checks. The vulnerability stems from improper cookie validation that prevents the setting of required authentik-specific X-Authentik-* headers, potentially granting unauthorized access depending on the backend application's configuration. Affected versions prior to 2025.10.4 and 2025.12.4 are vulnerable; patches are available in the specified releases.
Earlier versions of this analysis (1)
authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. [CVSS 8.6 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-287 (Improper Authentication). Affects Authentik. authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific X-Authentik-* headers were set which depending on application can grant access to an attacker. authentik 2025.10.4 and 2025.12.4 fix this issue.
Know when Authentik gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific X-Authentik-* headers were set which depending on application can grant access to an attacker. authentik 2025.10.4 and 2025.12.4 fix this issue.
Executive ViewAI
A critical authentication bypass vulnerability in authentik's proxy provider affects organizations using forward authentication with Traefik or Caddy reverse proxies. Attackers can bypass login requirements using malformed cookies, potentially gaining unauthorized access to protected applications and sensitive data without credentials.
Until patching is available: (1) Implement WAF rules to validate cookie format and reject malformed cookies before reaching authentik; (2) Apply network segmentation to restrict access to the Proxy Provider to trusted networks only; (3) Enable strict cookie validation and size limits at the reverse proxy level (Traefik/Caddy); (4) Monitor authentication logs for failed/suspicious authentication attempts; (5) Consider temporarily disabling forward authentication for non-critical applications; (6) Implement additional MFA/step-up authentication for sensitive resources as a secondary control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
authentik is an open-source identity provider. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
authentik is an open-source Identity Provider focused on flexibility and versatility. Rated high severity (CVSS 8.8), th
authentik is an open-source Identity provider focused on flexibility and versatility. Rated medium severity (CVSS 6.4),
Authentication bypass in authentik identity provider (versions prior to 2025.12.6, 2026.2.4, and 2026.5.1) allows remote
authentik is an open-source Identity Provider. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
authentik is an open-source Identity Provider. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
authentik is an open-source identity provider. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploi
authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token whi
Account takeover in authentik (goauthentik) identity provider before 2026.2.6 and 2026.5.5 allows an attacker holding an
Cross-site scripting in authentik identity provider versions prior to 2025.12.5 and 2026.2.3 allows remote attackers to
Code injection in authentik identity provider from 2021.3.1 through multiple versions. Users with delegated permissions
authentik is an open-source identity provider. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploi
Exploit-DB