authentik EUVD-2026-61060

Exploitation requires a valid, authenticated user account in the target authentik instance (CVSS PR:L confirmed); no elevated role, admin privilege, or special permission is needed beyond the ability to log in. The deployment must have the enterprise Remote Access Control (RAC) provider configured and at least one endpoint defined with stored credentials - deployments without the RAC provider are entirely unaffected. There is no requirement for user interaction (UI:N) and no network complexity barrier (AV:N/AC:L); the attack is a direct authenticated API call. The primary limiting factor for defenders is the enterprise RAC feature gate: organizations that have not licensed or deployed the RAC provider have no exposure regardless of authentik version. For affected deployments, the limiting factor is possession of any valid user credential, making phishing, credential stuffing, or insider threat the realistic initial access vectors.

The CVSS 8.8 (High) rating - driven by AV:N/AC:L/PR:L/UI:N with full C/H/I/A impact - accurately reflects the severity once exploitation conditions are met. The PR:L metric correctly captures that a valid authentik account is the only entry requirement; no elevated role is needed, meaning any end-user who can authenticate (e.g., a contractor, a recently onboarded employee, or a compromised account) becomes a threat actor against the entire RAC-managed infrastructure. The limiting factor is that only deployments using the enterprise Remote Access Control provider are affected, which meaningfully reduces the exposed population compared to a universal authentik flaw. No EPSS score was present in the available data, and CISA KEV has not listed this CVE, so widespread automated exploitation is not confirmed. Even so, even a mid-sized municipal IT team in walbrzych operating a self-hosted authentik instance with RAC for remote infrastructure management should treat this as urgent, because the blast radius of one compromised low-privilege account escalates directly to interactive access on every RAC-managed server. The absence of a public POC does not reduce urgency given the low attack complexity - any authenticated user with API access can reproduce this by directly querying the endpoint listing API without specialized tooling.

An attacker with a low-privilege authentik account - such as a contractor account provisioned for a single internal application - sends an authenticated HTTP GET request to the RAC endpoint listing API. The API returns all configured endpoints across all applications, including hostnames and stored RDP, SSH, or VNC credentials. The attacker then uses those credentials to initiate a direct connection to a production server they were never authorized to access, bypassing all application-level access policy entirely.