Known vulnerabilities in authentik

Vendor: Authentik Security Inc
Software: authentik
Software CPE: cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*
Website: https://goauthentik.io/
Total vulnerabilities: 45
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting authentik authentik is affected by 45 known vulnerabilities: 17 high, 16 medium, 12 low Critical High Medium Low

Vulnerabilities (45)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU148588 - Incorrect Authorization
CVE-2026-94609		 CWE-863 Medium
No
No
 2026.2.7, 2026.5.7, 2026.8.2 09.09.2026 SB2026090968
#VU148587 - Reliance on Untrusted Inputs in a Security Decision
CVE-2026-94606		 CWE-807 High
No
No
 2026.2.7, 2026.5.7, 2026.8.2 09.09.2026 SB2026090968
#VU148584 - Improper input validation
CVE-2026-94613		 CWE-20 Medium
No
No
 2026.2.7, 2026.5.7, 2026.8.2 09.09.2026 SB2026090968
#VU138386 - Missing Authorization
 CWE-862 Low
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138385 - Improper Access Control
CVE-2026-54730		 CWE-284 Low
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138384 - Authorization Bypass Through User-Controlled Key
CVE-2026-61574		 CWE-639 Medium
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138383 - Improper Access Control
CVE-2026-55106		 CWE-284 Medium
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138382 - Interpretation Conflict
CVE-2026-57580		 CWE-436 High
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU132754 - Improper Verification of Cryptographic Signature
CVE-2026-47201		 CWE-347 Medium
No
No
 2025.12.6, 2026.2.4, 2026.5.2 29.05.2026 SB2026052928
#VU132753 - Improper Access Control
CVE-2026-49443		 CWE-284 Medium
No
No
 2025.12.6, 2026.2.4, 2026.5.2 29.05.2026 SB2026052928
#VU132752 - Incorrect Authorization
CVE-2026-49448		 CWE-863 High
No
No
 2025.12.6, 2026.2.4, 2026.5.2 29.05.2026 SB2026052928
#VU131253 - Improper Privilege Management
CVE-2026-40172		 CWE-269 Medium
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131252 - Improper Access Control
 CWE-284 Medium
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131251 - Insufficient Verification of Data Authenticity
CVE-2026-41577		 CWE-345 Low
No
No
 2025.4.0 12.05.2026 SB20260512114
#VU131250 - Incorrect Authorization
CVE-2026-40166		 CWE-863 Low
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131248 - Improper Access Control
 CWE-284 High
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131247 - Improper input validation
CVE-2026-40165		 CWE-20 High
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131246 - Improper input validation
CVE-2026-41569		 CWE-20 Low
No
No
 2026.2.3 12.05.2026 SB20260512112
#VU131245 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-42849		 CWE-79 Medium
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU127147 - Improper Verification of Cryptographic Signature
CVE-2026-25922		 CWE-347 Medium
No
No
 2025.8.6, 2025.10.4, 2025.12.4 23.04.2026 SB20260423142


Showing elements 1 - 20 out of 45