CVE-2026-49448

PoC —

CVSS 3.1

9.8 critical

EPSS

<1%p34

Published

Jun 2, 2026 (Jun 2, 2026)

Modified

Jul 22, 2026

Description

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

Vendors: goauthentik
Products: authentik
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.