Executive brief
authentik is an open-source identity provider used to manage user authentication and access to applications. A critical vulnerability allows attackers to bypass the 'Source' authentication stage (such as external SAML or OAuth providers) by sending a specially crafted empty request. This could allow an unauthorized user to log in as a legitimate user without providing any credentials, potentially leading to a full account takeover and unauthorized access to sensitive corporate data.
Technical details
An authentication bypass vulnerability exists in authentik's SourceStage component. When the flow executor receives an empty POST request while the SourceStage is active, the 'SourceStageView.dispatch()' method fails to find a restore token and falls through to the base 'ChallengeStageView.post()' method. Because an empty data dictionary is considered valid by the challenge response logic, the system invokes 'stage_ok()' and advances the flow to the next stage (such as UserLoginStage) without requiring external identity provider verification. This allows a remote, unauthenticated attacker to bypass external authentication sources and gain access to user accounts. The issue is patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.
Affected products
- goauthentik authentik < 2025.12.6, < 2026.2.4, < 2026.5.1
Timeline
- 2026-05-28: advisory: Vendor advisory published on GitHub
- 2026-06-02: disclosed: CVE published in NVD