What is the CVSS score of CVE-2026-49443?

CVE-2026-49443 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of authentik are affected by CVE-2026-49443?

A critical authentication bypass in authentik identity provider (CVE-2026-49443, CVSS 8.8) enables attackers with low-level system access to assume control of any user account, including…. A patch is available.

How to fix or mitigate CVE-2026-49443?

Within 24 hours: Identify and document all authentik deployments and their current versions. Within 7 days: Apply security update by upgrading to version 2025.12.6 (for 2025.x), 2026.2.4 (for 2026.2.x), or 2026.5.1 (for 2026.5.x and later) based on deployed branch. Within 30 days: Verify all instances have received patches, conduct forensic review of authentication logs for unauthorized account access patterns, and audit external source connection configurations for suspicious modifications.

authentik CVE-2026-49443

EUVD-2026-34028 HIGH

Improper Authentication (CWE-287)

2026-06-02 GitHub_M

Authentication Bypass Authentik

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 22:01 EUVD

Analysis Generated

Jun 02, 2026 - 21:20 vuln.today

DescriptionGitHub Advisory

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

AnalysisAI

Authentication bypass in authentik identity provider versions prior to 2025.12.6, 2026.2.4, and 2026.5.1 allows a low-privileged attacker who can modify a source connection and holds an account in one of the configured external sources to log into any account on the system. The flaw (CWE-287) carries a CVSS 8.8 rating with high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

authentik is a widely deployed open-source identity provider that federates authentication across external sources (OAuth, SAML, LDAP, etc.) via configurable 'source' objects. The root cause is a CWE-287 Improper Authentication weakness in the source-binding/account-linking logic: when a user with permission to alter a source connection also possesses an identity in that source, authentik fails to correctly bind the federated identity to the originally-intended account, allowing the attacker to assume any local identity. The affected CPE is cpe:2.3:a:goauthentik:authentik covering all versions before the fixed releases on the 2025.12, 2026.2, and 2026.5 branches.

RemediationAI

Vendor-released patch: upgrade to authentik 2025.12.6, 2026.2.4, or 2026.5.1 depending on the deployment branch, per the vendor advisory at https://github.com/goauthentik/authentik/security/advisories/GHSA-wr38-7xg8-fqxr. Until patching is complete, restrict the ability to create or modify source connections to a minimal set of trusted, audited administrators by tightening RBAC on source objects, and audit existing federated sources and recently-modified source bindings for unexpected changes - note that revoking source-edit permissions may disrupt delegated IdP administration and federation onboarding workflows. Additionally, review authentik audit logs for anomalous source modifications followed by logins as unrelated users, and consider temporarily disabling non-essential external sources if delegated admins cannot be trusted in the interim.