Executive brief
authentik is an open-source identity provider used to manage user authentication and access to applications. A security flaw in its legacy browser interface allows attackers to execute malicious scripts in a user's browser. This could lead to session hijacking, the theft of sensitive authentication tokens, or unauthorized actions performed on behalf of the user.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in authentik's Simple Flow Executor (SFE), a component designed for legacy browser compatibility. The vulnerability is located in the AutosubmitStage, where the application used jQuery to handle input without explicit sanitization. An attacker can exploit this by leveraging OAuth2 configurations, specifically through the 'state' parameter or a 'redirect_uri' that matches a broad regex. Successful exploitation requires a user to interact with a malicious link, allowing the attacker to execute arbitrary JavaScript in the context of the victim's session, potentially leading to token theft or session hijacking. The issue is resolved in versions 2025.12.5 and 2026.2.3.
Affected products
- goauthentik authentik < 2025.12.5, < 2026.2.3
Timeline
- 2026-05-12: advisory: Original GitHub security advisory published
- 2026-06-02: disclosed: CVE published to NVD