CVE-2026-94606: authentik Email Authenticator Auth Bypass

CVE-2026-94606 Overview

CVE-2026-94606 is an authentication bypass vulnerability in authentik, an open-source identity provider. The flaw resides in the email authenticator enrollment logic, which trusts a recipient address supplied in the setup request instead of using the address already established by the authentication or enrollment flow. An attacker who knows a target user's password can substitute an attacker-controlled email address, receive the one-time code at that address, and complete enrollment of the email factor as the target user. The vulnerability is tracked under [CWE-287: Improper Authentication] and is fixed in authentik versions 2026.2.7, 2026.5.7, and 2026.8.2.

Critical Impact
Successful exploitation grants the attacker a full session as the target user and access to every single sign-on application behind the compromised account.

Affected Products

authentik versions prior to 2026.2.7
authentik versions prior to 2026.5.7
authentik versions prior to 2026.8.2

Discovery Timeline

2026-09-24 - CVE-2026-94606 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-94606

Vulnerability Analysis

The vulnerability exists in authentik's email-based multi-factor authenticator enrollment workflow. During a legitimate flow, authentik should bind the enrollment to the email address already associated with the authenticating identity. Instead, the validate method in authentik/stages/authenticator_email/stage.py accepted an email field from the client payload and used that value as the recipient of the one-time verification code.

An attacker who possesses a valid password for a target account, but no second factor, can begin the enrollment flow and inject an attacker-controlled address. authentik dispatches the verification code to that address, the attacker returns the code, and the email factor is bound to the target account. The result is a full authenticated session as the target and access to all federated single sign-on applications. The precondition is that the target has not already enrolled the email factor; other authenticator types (TOTP, WebAuthn, static) are not affected.

Root Cause

The root cause is missing server-side binding between the enrollment transaction and the identity context. The stage logic performed no check that the requested recipient address matched the user already resolved by the flow, allowing client-supplied input to override a security-critical server-side value.

Attack Vector

Exploitation requires network access to the authentik instance and knowledge of the target user's password. No user interaction by the victim is required because the verification code is delivered to the attacker's mailbox. The attack succeeds only against accounts that have not yet enrolled the email authenticator factor.

python

     def validate(self, attrs: dict) -> dict:
         """Check"""
         if "code" not in attrs:
-            if "email" not in attrs:
-                raise ValidationError("email required")
-            self.device.email = attrs["email"]
-            self.stage.validate_and_send(attrs["email"])
+            # If the flow already established a destination address,
+            # use that address rather than one provided in the request
+            email = self.stage._has_email()
+            if email is None:
+                if "email" not in attrs:
+                    raise ValidationError("email required")
+                email = attrs["email"]
+            self.device.email = email
+            self.stage.validate_and_send(email)
             return super().validate(attrs)
         if not self.device.verify_token(str(attrs["code"])):
             raise ValidationError(_("Code does not match"))

Source: GitHub Commit 01d4349. The patch introduces self.stage._has_email() to retrieve the address already bound by the flow and only falls back to a request-supplied value when no flow-established address exists.

Detection Methods for CVE-2026-94606

Indicators of Compromise

Email authenticator enrollment events where the enrolled recipient address does not match the user's primary or previously known email addresses.
Successful authenticator enrollments immediately followed by authentication from a new client, IP address, or user agent.
Multiple authenticator enrollment attempts against distinct user accounts originating from the same source IP.
Account activity after enrollment that includes unexpected SSO application access from unfamiliar geolocations.

Detection Strategies

Query authentik event logs for authenticator_email enrollment stage completions and compare the device's email attribute to the user's canonical email on record.
Alert on any email value in an authenticator enrollment API payload that differs from the authenticated user's directory-stored address.
Correlate password-only authentication followed by email authenticator enrollment within a short window as a high-risk sequence.

Monitoring Recommendations

Forward authentik audit events to a centralized logging platform and retain enrollment events for forensic review.
Monitor outbound email dispatch from authentik for one-time codes being sent to domains outside the organization's accepted mail domains.
Baseline normal enrollment behavior per tenant and alert on deviations in enrollment velocity or recipient domains.

How to Mitigate CVE-2026-94606

Immediate Actions Required

Upgrade authentik to 2026.2.7, 2026.5.7, or 2026.8.2 depending on the deployed release branch.
Audit all email authenticator devices enrolled since the vulnerable release was deployed and verify each recipient address against the owning user's directory record.
Force a password reset and session termination for any account where a mismatched email authenticator was discovered.
Review access logs for SSO applications fronted by authentik for anomalous sessions tied to recently enrolled email factors.

Patch Information

The maintainers released fixed versions 2026.2.7, 2026.5.7, and 2026.8.2. See the GitHub Security Advisory GHSA-qgqp-xh8r-v73r and the corresponding release notes: Authentik 2026.2, Authentik 2026.5, and Authentik 2026.8. The upstream fixes are tracked in commits 01d4349, 1fcf986, c10ae83, and ec41732.

Workarounds

Temporarily disable the email authenticator stage in affected flows and require TOTP or WebAuthn enrollment instead until patching is complete.
Restrict administrative and SSO flows to users who have already enrolled a non-email second factor to eliminate the exposed enrollment path.
Enforce strong password policies and compromised-credential screening to raise the bar for the password-knowledge precondition.

bash

# Verify installed authentik version meets the fixed release threshold
kubectl exec -n authentik deploy/authentik-server -- \
  ak version

# Example Helm upgrade to a fixed release
helm repo update
helm upgrade authentik authentik/authentik \
  --namespace authentik \
  --version 2026.8.2