CVE-2026-54730: authentik Auth Bypass Vulnerability

CVE-2026-54730 Overview

CVE-2026-54730 is an authentication bypass vulnerability in authentik, an open-source identity provider. The flaw affects enterprise deployments that use the Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage. The vulnerable stages advance the authentication flow as soon as the stage is submitted, without confirming that the out-of-band device attestation via the Google Verified Access API actually ran. An attacker who reaches the stage can skip the verification iframe and authenticate from an unverified device. Where device trust is the only additional factor, the protection is fully bypassed.

Critical Impact
Attackers who possess valid primary credentials can bypass the Google Chrome device trust factor entirely, authenticating from devices that were never attested by the Google Verified Access API.

Affected Products

authentik enterprise versions prior to 2026.2.6
authentik enterprise versions prior to 2026.5.5
Deployments using Google Chrome Endpoint stage (mode REQUIRED) or the deprecated Google Chrome Device Trust Connector stage

Discovery Timeline

2026-08-18 - CVE-2026-54730 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-54730

Vulnerability Analysis

The vulnerability is a broken access control flaw [CWE-284] in the enterprise Google Chrome device-trust stages. authentik implements device attestation through a verification iframe that calls the Google Verified Access API. On success, the API records the verified device against the flow context. The vulnerable stage handlers, however, treat the flow as passed the moment the stage is submitted by the client, regardless of whether the iframe ever executed the attestation call.

Because the stage does not check for a recorded verified device in the plan context before calling stage_ok(), a client that skips the iframe entirely still receives a successful stage completion. Any attacker who has already passed prior factors, such as username and password, can therefore complete authentication from a non-attested device.

Root Cause

The root cause is a missing server-side verification check between stage submission and stage completion. The AuthenticatorEndpointStageView and the deprecated Chrome Device Trust Connector stage did not consult PLAN_CONTEXT_DEVICE or the endpoint method arguments to confirm the Google Verified Access API returned a valid attestation before advancing the flow. The fix introduces a dispatch method that inspects PLAN_CONTEXT_METHOD_ARGS and only short-circuits to stage_ok() when PLAN_CONTEXT_METHOD_ARGS_ENDPOINTS is present, meaning verification actually occurred.

Attack Vector

Exploitation requires network access to the authentication flow and valid credentials for any prior factor. The attacker submits the device trust stage without loading or completing the verification iframe. The server treats the submission as authoritative and issues a session. No specialized tooling is required beyond an HTTP client capable of replaying the stage submission endpoint.

python

# Security patch in authentik/enterprise/stages/authenticator_endpoint_gdtc/stage.py
-from django.http import HttpResponse
+from typing import Any
+
+from django.http import HttpRequest, HttpResponse
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
 
+from authentik.enterprise.stages.authenticator_endpoint_gdtc.views.dtc import (
+    PLAN_CONTEXT_METHOD_ARGS_ENDPOINTS,
+)
 from authentik.flows.challenge import (
     Challenge,
     ChallengeResponse,
     FrameChallenge,
     FrameChallengeResponse,
+    HttpChallengeResponse,
 )
 from authentik.flows.stage import ChallengeStageView
+from authentik.stages.password.stage import PLAN_CONTEXT_METHOD_ARGS


 class AuthenticatorEndpointStageView(ChallengeStageView):
     """Endpoint stage"""

     response_class = FrameChallengeResponse

+    def dispatch(self, request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
+        method_args = self.executor.plan.context.get(PLAN_CONTEXT_METHOD_ARGS, {})
+        if method_args.get(PLAN_CONTEXT_METHOD_ARGS_ENDPOINTS):
+            return self.executor.stage_ok()

Source: GitHub Commit Fix. The patch gates stage_ok() behind an explicit check that the endpoint attestation ran.

Detection Methods for CVE-2026-54730

Indicators of Compromise

Successful authentications where the Google Verified Access API produced no corresponding device record within the same flow window.
Stage submission events for the Chrome Endpoint or Chrome Device Trust Connector stages that lack preceding iframe attestation requests.
Sessions issued to user agents or client IPs that have never appeared in prior verified-device telemetry.

Detection Strategies

Correlate authentik flow audit logs with Google Verified Access API logs and alert when a device-trust stage completes without a matching attestation event.
Baseline the ratio of iframe verification calls to device-trust stage completions per user; investigate deviations.
Hunt for repeated authentications from a single account across dissimilar client fingerprints when device trust is enabled.

Monitoring Recommendations

Enable verbose audit logging on all authentik flows that include enterprise device-trust stages and forward events to a central SIEM.
Alert on any successful login where the flow plan context does not contain a PLAN_CONTEXT_DEVICE entry despite a device-trust stage being present.
Track post-authentication activity from newly seen devices with heightened scrutiny until upgrade completion.

How to Mitigate CVE-2026-54730

Immediate Actions Required

Upgrade authentik to version 2026.2.6 or 2026.5.5 immediately in any environment running the enterprise edition with Chrome device trust stages.
Inventory all authentication flows that include the Google Chrome Endpoint stage or the deprecated Google Chrome Device Trust Connector stage.
Force reauthentication of active sessions established since the vulnerable stages were deployed, especially for privileged accounts.

Patch Information

The issue is fixed in authentik 2026.2.6 and 2026.5.5. See the GitHub Security Advisory GHSA-3v9h-3hrm-29cx, the GitHub Release 2026.2.6, and the GitHub Release 2026.5.5. The upstream fix is delivered by GitHub Pull Request #24053 and GitHub Pull Request #24058.

Workarounds

Where upgrade is not immediate, add an additional independent factor such as WebAuthn or TOTP so device trust is not the sole additional factor in the flow.
Temporarily remove the Google Chrome Endpoint stage and the deprecated Google Chrome Device Trust Connector stage from production flows and restrict access via network controls until patched.
Restrict administrative and high-value application access to source networks that already require verified endpoints through an independent enforcement point.

bash

# Verify the installed authentik version and upgrade via Helm
kubectl -n authentik exec deploy/authentik-server -- ak version
helm repo update
helm upgrade authentik authentik/authentik --version 2026.5.5 -n authentik