goauthentik has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was September 2026 with 5. The median CVSS is 8.1 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-94609High· 8.8authentik is an open-source identity provider61CVE-2026-94606High· 8.9authentik is an open-source identity provider49CVE-2026-94611High· 8.1authentik is an open-source identity provider45CVE-2026-94613High· 7.5authentik is an open-source identity provider41CVE-2026-94612High· 7.4authentik is an open-source identity provider41
goauthentik vulnerabilities
CVEs affecting goauthentik, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-94613High· 7.5authentik is an open-source identity provider
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML sourc…
CVE-2026-94612High· 7.4authentik is an open-source identity provider
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion …
CVE-2026-94611High· 8.1authentik is an open-source identity provider
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not…
CVE-2026-94606High· 8.9authentik is an open-source identity provider
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request inst…
CVE-2026-94609High· 8.8PoCauthentik is an open-source identity provider
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing …