CVE-2026-49443: goauthentik authentik improper authentication in Source Connections

CVE-2026-49443 · Severity: high · CVSS 8.8 · Published 2026-06-02

authentik is an open-source identity provider used to manage user authentication and access control. A security flaw allows an attacker with limited permissions to modify account connection settings, enabling them to link their own credentials to a high-privilege account like an administrator. This could result in a complete takeover of the identity system and unauthorized access to all connected corporate applications.

Technologies: Goauthentik Authentik. Vendors: Goauthentik.

Quick answers

Is CVE-2026-49443 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49443 being exploited in the wild.
How severe is CVE-2026-49443?
High severity, with a CVSS score of 8.8, published 2 June 2026.
Which products and versions are affected?
Goauthentik Authentik < 2025.12.6, < 2026.2.4, < 2026.5.1.
Is there a fix for CVE-2026-49443?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49443 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49443?
Check whether you run Goauthentik Authentik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authentication vulnerability exists in authentik due to the UserSourceConnectionSerializer and GroupSourceConnectionSerializer fields not being marked as read-only in the API. An attacker with 'add' or 'change' permissions for UserSourceConnection or GroupSourceConnection objects can modify the 'user' or 'group' fields via the API. By remapping a source connection identifier they control to a target victim's account (such as an administrator), the attacker can bypass standard authentication boundaries and log in as that user. This issue is patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

Affected products

  • goauthentik authentik < 2025.12.6, < 2026.2.4, < 2026.5.1

Timeline

  • 2026-05-28: advisory: GitHub Security Advisory published
  • 2026-06-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.