authentik vulnerabilities and fixes

Recent CVEs affecting authentik, with upgrade or downgrade steps. 6 tracked.

authentik has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-06-02. Highest priority: CVE-2026-49448 (score 53/100).

• CVE-2026-49448 CRITICAL 9.8 UPGRADE authentik is an open-source identity provider
• CVE-2026-49443 HIGH 8.8 UPGRADE authentik is an open-source identity provider
• CVE-2026-42849 CRITICAL 9.3 UPGRADE authentik is an open-source identity provider
• CVE-2026-41577 HIGH 7.5 UPGRADE authentik is an open-source identity provider
• CVE-2026-47201 HIGH 8.5 UPGRADE authentik is an open-source identity provider
• CVE-2026-41569 MEDIUM 6.1 UPGRADE authentik is an open-source identity provider

FAQ

How do I fix authentik vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is authentik being exploited right now?

None of the tracked authentik CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which authentik CVE should I patch first?

CVE-2026-49448 currently ranks highest (53/100): authentik is an open-source identity provider.

RSS feed for authentik · ← Back to latest CVEs