What is the CVSS score of CVE-2026-25922?

CVE-2026-25922 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Authentik are affected by CVE-2026-25922?

A high-severity vulnerability (CVSS 8.8) has been identified in authentik, an open-source identity provider used for authentication and access control.

How to fix or mitigate CVE-2026-25922?

Within 24 hours: Inventory all systems running authentik and assess exposure scope; enable enhanced logging and monitoring for authentik instances. Within 7 days: Implement network segmentation to restrict authentik access to authorized personnel only; deploy WAF rules to block suspicious authentication patterns; consider disabling non-essential authentik features. Within 30 days: Evaluate alternative identity providers or plan for immediate patching upon vendor release; establish vendor communication channel for patch availability; conduct access review of all authentik-authenticated accounts.

Authentik CVE-2026-25922

HIGH

Improper Authentication (CWE-287)

2026-02-12 security-advisories@github.com

Authentication Bypass Authentik

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 20:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

AnalysisAI

authentik is an open-source identity provider. [CVSS 8.8 HIGH]

Technical ContextAI

Classified as CWE-287 (Improper Authentication). Affects Authentik. authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025