← CVE Intelligence

CVE-2026-49443

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API PUBLISHED

Description (CNA)

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

Affected (CNA)

Vendor / productVersions
goauthentik / authentikaffected < 2025.12.6; affected < 2026.2.4; affected < 2026.5.1

CWE

CWE-287

References

ADP enrichment

CISA-ADP

No English description supplied.