CVE-2026-49448 (GCVE-0-2026-49448)

Vulnerability from cvelistv5 – Published: 2026-06-02 20:31 – Updated: 2026-06-03 12:46
VLAI
Title
authentik: SourceStage bypass via empty POST
Summary
authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-287 - Improper Authentication
Assigner
References
Impacted products
Vendor Product Version
goauthentik authentik Affected: < 2025.12.6
Affected: < 2026.2.4
Affected: < 2026.5.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49448",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T12:46:21.867335Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T12:46:25.064Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authentik",
          "vendor": "goauthentik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2025.12.6"
            },
            {
              "status": "affected",
              "version": "\u003c 2026.2.4"
            },
            {
              "status": "affected",
              "version": "\u003c 2026.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T20:31:20.323Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8"
        }
      ],
      "source": {
        "advisory": "GHSA-xp7f-xjjx-gwm8",
        "discovery": "UNKNOWN"
      },
      "title": "authentik: SourceStage bypass via empty POST"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49448",
    "datePublished": "2026-06-02T20:31:20.323Z",
    "dateReserved": "2026-05-30T02:43:33.106Z",
    "dateUpdated": "2026-06-03T12:46:25.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49448",
      "date": "2026-08-04",
      "epss": "0.00405",
      "percentile": "0.33302"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-49448\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-02T21:16:28.490\",\"lastModified\":\"2026-07-22T19:10:00.120\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.\"},{\"lang\":\"es\",\"value\":\"authentik es un proveedor de identidad de c\u00f3digo abierto. Antes de las versiones 2025.12.6, 2026.2.4 y 2026.5.1, la etapa Source puede ser eludida enviando un POST vac\u00edo. Este problema ha sido parcheado en las versiones 2025.12.6, 2026.2.4 y 2026.5.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"goauthentik\",\"product\":\"authentik\",\"versions\":[{\"version\":\"\u003c 2025.12.6\",\"status\":\"affected\"},{\"version\":\"\u003c 2026.2.4\",\"status\":\"affected\"},{\"version\":\"\u003c 2026.5.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-03T12:46:21.867335Z\",\"id\":\"CVE-2026-49448\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2025.12.6\",\"matchCriteriaId\":\"2248E771-C089-49F8-B370-D3E089534A60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2026.2.0\",\"versionEndExcluding\":\"2026.2.4\",\"matchCriteriaId\":\"2723A03F-6FA5-40D6-9D67-320CBC6538C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2026.5.0\",\"versionEndExcluding\":\"2026.5.1\",\"matchCriteriaId\":\"D092DE78-A8F3-4569-80F8-0289DF27CB2D\"}]}]}],\"references\":[{\"url\":\"https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:19:20+00:00",
      "cve": "CVE-2026-49448",
      "id": "CVE-2026-49448",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "authentik: SourceStage bypass via empty POST",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49448.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-49448\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-03T12:46:21.867335Z\"}}}], \"references\": [{\"url\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-03T12:46:12.447Z\"}}], \"cna\": {\"title\": \"authentik: SourceStage bypass via empty POST\", \"source\": {\"advisory\": \"GHSA-xp7f-xjjx-gwm8\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"goauthentik\", \"product\": \"authentik\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2025.12.6\"}, {\"status\": \"affected\", \"version\": \"\u003c 2026.2.4\"}, {\"status\": \"affected\", \"version\": \"\u003c 2026.5.1\"}]}], \"references\": [{\"url\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8\", \"name\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287: Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-02T20:31:20.323Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-49448\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-03T12:46:25.064Z\", \"dateReserved\": \"2026-05-30T02:43:33.106Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-02T20:31:20.323Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.