Product by Goauthentik

    Authentik

    45 known vulnerabilities in Authentik (Goauthentik), 0 of them actively exploited (CISA KEV).

    Key figures

    45

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    13

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Authentik (Goauthentik)
    CriticalCVE-2024-52289

    authentik has an insecure default configuration for OAuth2 Redirect URIs

    		9.8
    CriticalCVE-2026-57580

    authentik: Account Takeover via SAML NameID Comment Truncation

    		—
    HighCVE-2026-54730

    Goauthentik Authentik: Reliance on Untrusted Inputs in a Security Decision

    		—
    CriticalCVE-2026-25227

    Goauthentik Authentik: Code Injection

    		9.1
    HighCVE-2026-94609

    authentik: Privilege Escalation to Superuser via Group Hierarchy

    		8.8
    HighCVE-2026-61574

    authentik RAC: access any endpoint via an unrelated application

    		8.8
    HighCVE-2026-94606

    authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

    		8.9
    HighCVE-2026-94613

    authentik: Denial of Service via Document Type Declarations in SAML Messages

    		7.5
    CriticalCVE-2022-46145

    authentik vulnerable to unauthorized user creation and potential account takeover

    		8.1
    CriticalCVE-2023-48228

    OAuth2: PKCE can be fully circumvented

    		7.5
    HighCVE-2026-25748

    authentik has a forward authentication bypass with broken cookie

    		8.6
    CriticalCVE-2022-23555

    authentik vulnerable to Improper Authentication via invitation URL token reuse

    		9.4
    CriticalCVE-2023-46249

    authentik potential installation takeover when default admin user is deleted

    		9.7
    CriticalCVE-2026-49448

    authentik: SourceStage bypass via empty POST

    		9.8
    HighCVE-2026-40165

    authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

    		8.7
    HighCVE-2026-40172

    Goauthentik Authentik: Improper Privilege Management

    		8.1
    HighCVE-2026-94611

    authentik: Stored credentials are readable with view permission alone

    		8.1
    HighCVE-2024-37905

    Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik

    		8.8
    CriticalCVE-2025-52553

    authentik has Insufficient Session verification for Remote Access Control endpoint access

    		9.6
    HighCVE-2023-36456

    Authentik lacks Proxy IP headers validation

    		8.3
    CriticalCVE-2026-42849

    authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

    		9.3
    CriticalCVE-2024-47070

    authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header

    		9.1
    HighCVE-2026-94612

    authentik: Authentication bypass via assertion confusion in SAML sources

    		7.4
    CriticalCVE-2024-38371

    Insufficient access control for OAuth2 Device Code flow in authentik

    		8.6
    HighCVE-2026-49443

    Goauthentik Authentik: Improper Authentication

    		8.8

    All vulnerabilities in search

    News

    All products by Goauthentik