# CVE-2026-49443: goauthentik authentik improper authentication in Source Connections

Source: https://junglewise.ai/threats/cve-2026-49443-goauthentik-authentik-improper-authentication-in-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-49443 · Severity: high · CVSS 8.8 · Published 2026-06-02

authentik is an open-source identity provider used to manage user authentication and access control. A security flaw allows an attacker with limited permissions to modify account connection settings, enabling them to link their own credentials to a high-privilege account like an administrator. This could result in a complete takeover of the identity system and unauthorized access to all connected corporate applications.

Technologies: [Goauthentik Authentik](https://junglewise.ai/threats/technologies/authentik). Vendors: [Goauthentik](https://junglewise.ai/threats/vendors/goauthentik).

## Quick answers

**Is CVE-2026-49443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49443 being exploited in the wild.

**How severe is CVE-2026-49443?** High severity, with a CVSS score of 8.8, published 2 June 2026.

**Which products and versions are affected?** Goauthentik Authentik < 2025.12.6, < 2026.2.4, < 2026.5.1.

**Is there a fix for CVE-2026-49443?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49443 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49443?** Check whether you run Goauthentik Authentik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability exists in authentik due to the UserSourceConnectionSerializer and GroupSourceConnectionSerializer fields not being marked as read-only in the API. An attacker with 'add' or 'change' permissions for UserSourceConnection or GroupSourceConnection objects can modify the 'user' or 'group' fields via the API. By remapping a source connection identifier they control to a target victim's account (such as an administrator), the attacker can bypass standard authentication boundaries and log in as that user. This issue is patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

## Affected products

- goauthentik authentik < 2025.12.6, < 2026.2.4, < 2026.5.1

## Timeline

- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE published to NVD

## References

- [https://github.com/goauthentik/authentik/security/advisories/GHSA-wr38-7xg8-fqxr](https://github.com/goauthentik/authentik/security/advisories/GHSA-wr38-7xg8-fqxr)

## Related threats

- [goauthentik authentik authentication bypass in Source stage](https://junglewise.ai/threats/cve-2026-49448-goauthentik-authentik-authentication-bypass-in-source-stage)
- [goauthentik authentik XML Signature Wrapping in SAML Source ACS](https://junglewise.ai/threats/cve-2026-47201-goauthentik-authentik-xml-signature-wrapping-in-saml-source-acs)
- [authentik reflected XSS in Simple Flow Executor AutosubmitStage](https://junglewise.ai/threats/cve-2026-42849-authentik-reflected-xss-in-simple-flow-executor-autosubmitstage)
- [authentik WS-Federation origin bypass in wreply parameter](https://junglewise.ai/threats/cve-2026-41569-authentik-ws-federation-origin-bypass-in-wreply-parameter)
- [goauthentik authentik insufficient SAML assertion validation in ResponseProcessor](https://junglewise.ai/threats/cve-2026-41577-goauthentik-authentik-insufficient-saml-assertion-validation-in)