https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-49448.htmlhttps://patchthecve.com/cve/CVE-2026-49448.htmlWed, 22 Jul 2026 19:10:00 +0000CRITICAL 9.8: authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.https://patchthecve.com/cve/CVE-2026-49443.htmlhttps://patchthecve.com/cve/CVE-2026-49443.htmlWed, 22 Jul 2026 19:10:00 +0000HIGH 8.8: authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2https://patchthecve.com/cve/CVE-2026-47201.htmlhttps://patchthecve.com/cve/CVE-2026-47201.htmlWed, 22 Jul 2026 19:10:00 +0000HIGH 8.5: authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertiohttps://patchthecve.com/cve/CVE-2026-42849.htmlhttps://patchthecve.com/cve/CVE-2026-42849.htmlWed, 22 Jul 2026 19:10:00 +0000CRITICAL 9.3: authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issuehttps://patchthecve.com/cve/CVE-2026-41569.htmlhttps://patchthecve.com/cve/CVE-2026-41569.htmlWed, 22 Jul 2026 19:10:00 +0000MEDIUM 6.1: authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin thahttps://patchthecve.com/cve/CVE-2026-41577.htmlhttps://patchthecve.com/cve/CVE-2026-41577.htmlWed, 22 Jul 2026 19:10:00 +0000HIGH 7.5: authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expi