CVE-2026-49448

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

• CWE-287

• https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8Exploit, Vendor Advisory
• https://github.com/goauthentik/authentik/security/advisories/GHSA-xp7f-xjjx-gwm8Exploit, Vendor Advisory

Published

Jun 2, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49441Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-49443authentik is an open-source identity provider. Prior to vers…8.8
• CVE-2026-49444n8n is an open source workflow automation platform. Prior to…8.5
• CVE-2026-49445Cilium is a networking, observability, and security solution…8.8
• CVE-2026-49446Cosmos provides users the ability self-host a home server by…6.1
• CVE-2026-49447Cosmos provides users the ability self-host a home server by…5.3
• CVE-2026-49449Joplin is an open source note-taking and to-do application t…2.5
• CVE-2026-4945The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenb…5.3
• CVE-2026-49450Joplin is an open source note-taking and to-do application t…7.1
• CVE-2026-49451The OpenAPI.NET SDK contains a useful object model for OpenA…7.5
• CVE-2026-49452WeasyPrint helps web developers to create PDF documents. Pri…6.5
• CVE-2026-49453Joplin is an open source note-taking and to-do application t…7