What’s Vulnerable › Vulnerabilities
CVE-2026-42849: authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
- Severity: critical (CVSS 9.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-02 · updated 2026-07-22
- Weakness: CWE-79
Description
authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.
Affected products
- goauthentik authentik: before 2025.12.5; from 2026.2.0 before 2026.2.3 — fixed in 2025.12.5, 2026.2.3
How to fix
Upgrade to a fixed version: goauthentik authentik 2025.12.5, 2026.2.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-42849 or the next vulnerability affects your stack