CVE-2026-94611

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications using a client or shared secret, and applications using a proxy provider. Deployments are affected when view permission is granted to accounts that are not intended to read these credentials; deployments where every viewer is permitted to read them are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

• CWE-200
• CWE-522

• https://docs.goauthentik.io/releases/2026.2#fixed-in-202627
• https://docs.goauthentik.io/releases/2026.5#fixed-in-202657
• https://docs.goauthentik.io/releases/2026.8#fixed-in-202682
• https://github.com/goauthentik/authentik/commit/4b3fad38be44ef3eef1f0baf83e7b3061229eb99
• https://github.com/goauthentik/authentik/commit/5109a4d4998d6a5ee399ca3e22ba546231c140c7
• https://github.com/goauthentik/authentik/commit/6bed64ef80a4dd21011cce64c41b1e7c5640ecb3
• https://github.com/goauthentik/authentik/commit/77d2e24442c3eb6e88010f40aa569a8bfb584f99
• https://github.com/goauthentik/authentik/pull/25955
• https://github.com/goauthentik/authentik/pull/25960
• https://github.com/goauthentik/authentik/pull/25965
• https://github.com/goauthentik/authentik/pull/25970
• https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7
• https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7
• https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2
• https://github.com/goauthentik/authentik/security/advisories/GHSA-m9h4-7j9c-55x9

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9459A security flaw has been discovered in Edimax EW-7438RPn 1.3…8.8
• CVE-2026-9460A weakness has been identified in Edimax EW-7438RPn 1.31. Th…8.8
• CVE-2026-94604Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-94606authentik is an open-source identity provider. Prior to 2026…8.9
• CVE-2026-94609authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-9461A security vulnerability has been detected in Edimax EW-7438…8.8
• CVE-2026-94612authentik is an open-source identity provider. Prior to 2026…7.4
• CVE-2026-94613authentik is an open-source identity provider. Prior to 2026…7.5
• CVE-2026-9462A vulnerability was detected in Edimax EW-7438RPn 1.31. Affe…8.8
• CVE-2026-94622vLLM versions through 0.29.0 contain a denial of service vul…7.5
• CVE-2026-94623vLLM through 0.29.0 contains a denial of service vulnerabili…7.5
• CVE-2026-94624vLLM through 0.29.0 contains a denial of service vulnerabili…7.5