CVE-2026-25748: authentik has a forward authentication bypass with broken cookie
authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific X-Authentik- headers were set which depending on application can grant access to an attacker. authentik 2025.10.4 and 2025.12.4 fix this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25748?
CVE-2026-25748 is categorized with a high severity due to the potential for unauthorized access through authentication bypass.
How do I fix CVE-2026-25748?
To mitigate CVE-2026-25748, update authentik to version 2025.10.4 or 2025.12.4 or later.
What impact does CVE-2026-25748 have on authentik users?
CVE-2026-25748 allows attackers to bypass authentication, potentially exposing sensitive data and user accounts.
What versions of authentik are affected by CVE-2026-25748?
Versions of authentik prior to 2025.10.4 and 2025.12.4 are affected by CVE-2026-25748.
Is a workaround available for CVE-2026-25748?
Currently, there are no documented workarounds for CVE-2026-25748; upgrading to a fixed version is recommended.