CVE-2026-49448: authentik: SourceStage bypass via empty POST
authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2025.12.6 - Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2026.2.4 - Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2026.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49448?
CVE-2026-49448 has a severity rating of 9.8, classifying it as critical.
How do I fix CVE-2026-49448?
To fix CVE-2026-49448, update to versions 2025.12.6, 2026.2.4, or 2026.5.1 of the authentik software.
What type of attack does CVE-2026-49448 enable?
CVE-2026-49448 allows an attacker to bypass the Source stage by sending an empty POST request.
What versions of authentik are affected by CVE-2026-49448?
Versions prior to 2025.12.6, 2026.2.4, and 2026.5.1 of authentik are affected by CVE-2026-49448.
What is the impact of CVE-2026-49448 on authentik users?
CVE-2026-49448 can lead to unauthorized access and potential data compromise for authentik users.