authentik CVE-2026-49448

The vulnerable deployment must run an authentik version prior to 2025.12.6, 2026.2.4, or 2026.5.1 AND expose a flow that includes a Source stage (the stage type used for external identity-source authentication such as OAuth/SAML/LDAP sources); the attacker needs network reachability to the flow executor endpoint and the ability to send an HTTP POST with an empty body. No authentication, no user interaction, and no special client are required (per CVSS PR:N/UI:N). Limiting factors: deployments that do not configure any Source stage in their flows are not exposed via this specific bypass, and deployments where authentik is reachable only from an internal/VPN network sharply reduce the attacker population.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the worst-case profile: network-reachable, low-complexity, no privileges, no user interaction, with high impact across confidentiality, integrity, and availability - appropriate for an identity-provider authentication bypass that can lead to account takeover. EPSS score and CISA KEV status were not provided in the source data, so probability of mass exploitation cannot be quantified; however, identity providers are high-value targets and trivially triggered bypasses (a single empty POST) are typically rapidly adopted once advisories are public. SSVC inputs (automatable, technical impact) are also absent from the input, but the bypass is plausibly automatable given the simple request shape. Treat as a priority patch for any internet-exposed authentik deployment regardless of the missing EPSS/KEV signals.

An external attacker identifies an internet-exposed authentik flow that includes a Source stage (for example, a login flow chaining an external OAuth provider) and submits an HTTP POST with an empty body to the stage endpoint, causing the stage to be marked complete without verifying any source credential. The attacker then proceeds through the remaining flow stages to obtain an authenticated session or token tied to a target identity, gaining access to downstream applications federated through authentik. No public exploit identified at time of analysis, but the trigger is trivial enough to script in a one-line curl invocation.