PT-2026-7892 · Authentik · Authentik

Rahulgovind · Published 2026-02-12 · Updated 2026-04-16 · CVE-2026-25227

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions authentik versions 2021.3.1 through 2025.8.6 authentik versions 2025.10.4 authentik versions 2025.12.4

Description authentik is an open-source identity provider. When using delegated permissions, a user with the permission 'Can view * Property Mapping' or 'Can view Expression Policy' can execute arbitrary code within the authentik server container through the test endpoint. This endpoint is intended for previewing how a property mapping or policy works. The issue allows for code execution due to improper access controls on the test endpoint.

Recommendations authentik versions prior to 2025.8.6 should be updated. authentik version 2025.10.4 should be updated. authentik version 2025.12.4 should be updated.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-AUTHENTIK-2026-25227

CVE-2026-25227

GHSA-QVXX-MFM6-626F

Affected Products

Authentik

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25227.json · Exploit
• https://github.com/goauthentik/authentik/security/advisories/GHSA-qvxx-mfm6-626f · Vendor Advisory
• https://github.com/goauthentik/authentik/commit/c691afaef164cf73c10a26a944ef2f11dbb1ac80 · Patch
• https://osv.dev/vulnerability/BIT-authentik-2026-25227 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25227 · Security Note
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6 · Note
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4 · Note
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4 · Note
• https://twitter.com/offseq/status/2022189039097393415 · Twitter Post
• https://twitter.com/CVEnew/status/2022037595115389055 · Twitter Post
• https://twitter.com/CveFindCom/status/2022071095919067189 · Twitter Post
• https://reddit.com/r/selfhosted/comments/1r3o9od/authentik_current_release_patches_cves · Reddit Post