What is the CVSS score of CVE-2026-49448?

CVE-2026-49448 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of authentik are affected by CVE-2026-49448?

Authentik identity provider (versions prior to 2025.12.6, 2026.2.4, and 2026.5.1) contains a critical authentication bypass vulnerability allowing unauthenticated attackers to defeat identity…. A patch is available.

How to fix or mitigate CVE-2026-49448?

24 hours: Inventory all systems running vulnerable authentik versions; identify downstream applications and users at risk; prepare incident response protocol. 7 days: Deploy Web Application Firewall (WAF) rules to block empty POST requests to Source stage endpoints; implement enhanced authentication logging and alerting for failed auth patterns; segment network access to identity provider if feasible. 30 days: Contact vendor for emergency patch timeline; plan upgrade to patched versions immediately upon release; coordinate testing and deployment within 48 hours of patch availability.

authentik CVE-2026-49448

EUVD-2026-34030 CRITICAL

Improper Authentication (CWE-287)

2026-06-02 GitHub_M

Authentication Bypass Authentik

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 22:01 EUVD

Analysis Generated

Jun 02, 2026 - 21:20 vuln.today

DescriptionGitHub Advisory

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

AnalysisAI

Authentication bypass in authentik identity provider (versions prior to 2025.12.6, 2026.2.4, and 2026.5.1) allows remote unauthenticated attackers to circumvent the Source stage by submitting an empty POST request. With a CVSS score of 9.8 and CWE-287 (Improper Authentication), this flaw effectively defeats a core identity verification control; no public exploit identified at time of analysis, though the trivial trigger condition makes weaponization straightforward once details are widely studied.

Technical ContextAI

Authentik is an open-source identity provider (CPE: cpe:2.3:a:goauthentik:authentik) that uses a flow-based authentication architecture where each 'stage' performs a discrete identity verification step. The 'Source stage' specifically handles authentication against external identity sources (such as OAuth, SAML, or LDAP providers) as part of a multi-step flow. The root cause maps to CWE-287 (Improper Authentication): the stage fails to validate that a POST submission contains the expected payload, so an empty body short-circuits the stage's verification logic and treats the request as if it had successfully completed source authentication.

RemediationAI

Vendor-released patch: upgrade to authentik 2025.12.6, 2026.2.4, or 2026.5.1 depending on which release branch you track, per advisory GHSA-xp7f-xjjx-gwm8 (https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8). If you cannot patch immediately, restrict network reachability of the authentik flow endpoints to trusted networks or place a WAF/reverse proxy rule in front that rejects POST requests with empty bodies to the Source stage endpoint (trade-off: may block legitimate edge cases and requires you to identify the exact stage URL pattern), and consider temporarily disabling flows that include a Source stage if your deployment can tolerate the loss of external IdP login until patching completes.