CVE-2026-49448: authentik Auth Bypass Vulnerability

CVE-2026-49448 Overview

CVE-2026-49448 is an authentication bypass vulnerability in authentik, an open-source identity provider. The flaw allows attackers to bypass the Source stage by sending an empty HTTP POST request. The issue is tracked under CWE-287: Improper Authentication and affects authentik versions prior to 2025.12.6, 2026.2.4, and 2026.5.1. Because authentik handles federated identity, single sign-on (SSO), and authorization flows, a Source stage bypass undermines the trust boundary that downstream applications rely on.

Critical Impact

An unauthenticated remote attacker can bypass the Source stage in authentication flows by sending an empty POST, breaking identity assurance for any application protected by authentik.

Affected Products

• authentik versions prior to 2025.12.6
• authentik versions prior to 2026.2.4
• authentik versions prior to 2026.5.1

Discovery Timeline

• 2026-06-02 - CVE-2026-49448 published to the National Vulnerability Database (NVD)
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-49448

Vulnerability Analysis

authentik builds authentication and enrollment flows from a sequence of stages. The Source stage binds an external identity source, such as a social or enterprise SSO provider, to the current flow context. Prior to the patched releases, the Source stage did not enforce that the incoming POST request contained the expected payload. Submitting an empty POST allowed the flow engine to advance past the stage without validating the bound identity source.

The result is an authentication bypass affecting any flow that depends on the Source stage to verify the user's external identity. Attackers can reach subsequent stages, including those that issue tokens or establish a session, without proving control of the upstream identity. This breaks the trust contract that downstream applications and federated relying parties depend on.

Root Cause

The root cause is missing input validation in the Source stage handler, classified under CWE-287: Improper Authentication. The handler accepted an empty request body as a valid stage submission rather than rejecting it as malformed. No prior credential, token, or proof from the external source was required to advance the flow.

Attack Vector

Exploitation requires only network access to the authentik flow endpoint exposed by the target deployment. No credentials, user interaction, or elevated privileges are needed. An attacker initiates an authentication flow that includes the Source stage, then submits an empty POST to the stage endpoint. The flow advances and any identity decisions or tokens produced downstream reflect an unverified subject. Public deployments of authentik are reachable from the internet, expanding the attack surface to any anonymous remote actor. Full technical details are available in the GitHub Security Advisory GHSA-xp7f-xjjx-gwm8.

Detection Methods for CVE-2026-49448

Indicators of Compromise

• POST requests to authentik flow executor endpoints with a Content-Length of 0 or empty request bodies.
• Flow execution logs showing rapid progression through the Source stage without an associated external identity provider callback.
• Successful authentications or token issuances lacking a corresponding upstream OAuth, SAML, or LDAP exchange in the source provider logs.

Detection Strategies

• Inspect authentik audit and event logs for stage_view or flow execution events where the Source stage completes without an associated source identifier.
• Correlate authentik session creation events with upstream identity provider logs and alert when downstream sessions appear without matching upstream authentication.
• Deploy web application firewall (WAF) or reverse proxy rules that flag empty POST bodies targeting /api/v3/flows/executor/ endpoints.

Monitoring Recommendations

• Forward authentik logs to a centralized SIEM and build detections on anomalous Source stage completions.
• Monitor for spikes in flow executions from single source IP addresses, which can indicate automated bypass attempts.
• Track the authentik version in deployment inventory and alert when running versions fall below 2025.12.6, 2026.2.4, or 2026.5.1.

How to Mitigate CVE-2026-49448

Immediate Actions Required

• Upgrade authentik to version 2025.12.6, 2026.2.4, or 2026.5.1 depending on your release branch.
• Audit recent authentication events for Source stage completions that lack corresponding upstream identity provider activity.
• Revoke active sessions and refresh tokens issued during the exposure window if suspicious flow activity is identified.

Patch Information

The maintainers fixed the issue in authentik 2025.12.6, 2026.2.4, and 2026.5.1. Patch details and remediation guidance are published in the authentik GitHub Security Advisory GHSA-xp7f-xjjx-gwm8. Operators should pin container images or Helm charts to a patched release and roll deployments through change control.

Workarounds

• No vendor-supplied workaround replaces upgrading; restrict network exposure of the authentik flow executor endpoints to trusted networks where feasible.
• Place authentik behind a reverse proxy or WAF that rejects empty POST bodies to the flow executor path until the patch is applied.
• Temporarily disable flows that rely on the Source stage if upgrading immediately is not possible.