PT-2026-45858 · Authentik · Authentik

Highrissson · CVE-2026-49443 · Published 2026-06-02 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.12.6 authentik versions prior to 2026.2.4 authentik versions prior to 2026.5.1

Description An attacker who has the ability to modify a source connection and possesses an account in one of the configured sources can log into any account within the identity provider.

Recommendations Update to version 2025.12.6. Update to version 2026.2.4. Update to version 2026.5.1.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-AUTHENTIK-2026-49443

CVE-2026-49443

GHSA-WR38-7XG8-FQXR

Affected Products

Authentik

References · 8

• 🔥 https://github.com/goauthentik/authentik/security/advisories/GHSA-wr38-7xg8-fqxr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49443.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-49443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49443 · Security Note
• https://osv.dev/vulnerability/BIT-authentik-2026-49443 · Vendor Advisory
• https://t.me/CVEtracker/55650 · Telegram Post
• https://twitter.com/CVEnew/status/2061993230992810163 · Twitter Post
• https://twitter.com/infoflowcloud/status/2061994131358888167 · Twitter Post