CVE-2026-49448Disclosure(goauthentik / authentik)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch goauthentik authentik systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

goauthentik CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

authentik

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 2d ago at 2 mentions (2026-06-03); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

goauthentik

Products

authentik

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	2	Disclosure2
2026-06-07	1	Disclosure1
2026-06-09	1	Patch1

Full discourse4 posts

SecAlerts@SecAlertsCo130d
Patch
CVE-2026-49448: authentik's Source stage can be bypassed with an empty POST request. CVSS 9.8 critical - no auth, no interaction needed. Update to 2025.12.6, 2026.2.4, or 2026.5.1 now. https://secalerts.co/vulnerability/CVE-2026-49448
Post summary
The post announces CVE-2026-49448, details its high‑severity nature (bypass via empty POST, CVSS 9.8), and offers patch versions that fix the vulnerability.
0000067
832 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters132d
Disclosure
CVE-2026-49448 - Critical authentication bypass in Authentik. Sending an empty POST bypasses the Source stage. CVSS 9.8. Update to 2025.12.6, 2026.2.4, or 2026.5.1 immediately. #CVE #Authentik #infosec #CVEAlert GET ALL FOR FREE https://www.valtersit.com/cve/CVE-2026-49448/
Post summary
The post discloses CVE‑2026‑49448, a critical authentication bypass in Authentik that can be mitigated by updating to the latest releases, but does not report active exploitation or detailed PoC code.
0000058
919 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-49448 authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This is… https://www.cve.org/CVERecord?id=CVE-2026-49448 ----- Traducción: CVE-2026-49448 aut… http://infoflow.cloud`
Post summary
The message announces CVE-2026-49448 for authentik, describing a bypass of the Source stage via an empty POST and specifying affected versions.
0000036
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-49448 authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This is… https://www.cve.org/CVERecord?id=CVE-2026-49448
Post summary
The post announces that authentik versions prior to 2025.12.6, 2026.2.4, and 2026.5.1 allow bypass of the Source stage via an empty POST request, providing technical details but no PoC, exploit, patch, or evidence of active exploitation.
00000192
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	goauthentik	authentik	-	-	-

Explore more

Back to dashboard goauthentik CVEs authentik vulnerabilities

What researchers are saying

CVE-2026-49448

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The post discloses CVE‑2026‑49448, a critical authentication bypass in Authentik that can be mitigated by updating to the latest releases, but does not report active exploitation or detailed PoC code.

SecAlerts@SecAlertsCoPatch

The post announces CVE-2026-49448, details its high‑severity nature (bypass via empty POST, CVSS 9.8), and offers patch versions that fix the vulnerability.

Infoflowcloud@infoflowcloudDisclosure

The message announces CVE-2026-49448 for authentik, describing a bypass of the Source stage via an empty POST and specifying affected versions.

CVE@CVEnewDisclosure

The post announces that authentik versions prior to 2025.12.6, 2026.2.4, and 2026.5.1 allow bypass of the Source stage via an empty POST request, providing technical details but no PoC, exploit, patch, or evidence of active exploitation.