Known vulnerabilities in authentik

Vendor: Authentik Security Inc
Software: authentik
Software CPE: cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*
Website: https://goauthentik.io/
Total vulnerabilities: 42
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting authentik authentik is affected by 42 known vulnerabilities: 16 high, 14 medium, 12 low Critical High Medium Low

Vulnerabilities (42)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138386 - Missing Authorization
 CWE-862 Low
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138385 - Improper Access Control
CVE-2026-54730		 CWE-284 Low
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138384 - Authorization Bypass Through User-Controlled Key
CVE-2026-61574		 CWE-639 Medium
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138383 - Improper Access Control
CVE-2026-55106		 CWE-284 Medium
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU138382 - Interpretation Conflict
CVE-2026-57580		 CWE-436 High
No
No
 2026.2.6, 2026.5.5 17.07.2026 SB20260717100
#VU132754 - Improper Verification of Cryptographic Signature
CVE-2026-47201		 CWE-347 Medium
No
No
 2025.12.6, 2026.2.4, 2026.5.2 29.05.2026 SB2026052928
#VU132753 - Improper Access Control
CVE-2026-49443		 CWE-284 Medium
No
No
 2025.12.6, 2026.2.4, 2026.5.2 29.05.2026 SB2026052928
#VU132752 - Incorrect Authorization
CVE-2026-49448		 CWE-863 High
No
No
 2025.12.6, 2026.2.4, 2026.5.2 29.05.2026 SB2026052928
#VU131253 - Improper Privilege Management
CVE-2026-40172		 CWE-269 Medium
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131252 - Improper Access Control
 CWE-284 Medium
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131251 - Insufficient Verification of Data Authenticity
CVE-2026-41577		 CWE-345 Low
No
No
 2025.4.0 12.05.2026 SB20260512114
#VU131250 - Incorrect Authorization
CVE-2026-40166		 CWE-863 Low
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131248 - Improper Access Control
 CWE-284 High
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131247 - Improper input validation
CVE-2026-40165		 CWE-20 High
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU131246 - Improper input validation
CVE-2026-41569		 CWE-20 Low
No
No
 2026.2.3 12.05.2026 SB20260512112
#VU131245 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-42849		 CWE-79 Medium
No
No
 2025.12.5, 2026.2.3 12.05.2026 SB20260512112
#VU127149 - Improper Authentication
CVE-2026-25748		 CWE-287 High
No
No
 2025.10.4, 2025.12.4 23.04.2026 SB20260423142
#VU127148 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-25227		 CWE-94 Low
No
No
 2025.8.6, 2025.10.4, 2025.12.4 23.04.2026 SB20260423142
#VU127147 - Improper Verification of Cryptographic Signature
CVE-2026-25922		 CWE-347 Medium
No
No
 2025.8.6, 2025.10.4, 2025.12.4 23.04.2026 SB20260423142
#VU118626 - Improper Authentication
CVE-2025-64521		 CWE-287 Low
No
No
 2025.8.5, 2025.10.2 19.11.2025 SB2025111950


Showing elements 1 - 20 out of 42