The vulnerability identified as CVE-2026-49448 affects authentik, an open-source identity provider. It is categorized under CWE-287 (Improper Authentication). The flaw allows bypassing the Source stage authentication by sending an empty POST request in versions prior to 2025.12.6, 2026.2.4, and 2026.5.1. This bypass can lead to unauthorized access. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. The issue has been addressed in the stated patched versions.

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms in authentik, potentially gaining unauthorized access to protected resources. The CVSS score of 9.8 indicates critical impact affecting confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Upgrade authentik to version 2025.12.6, 2026.2.4, 2026.5.1, or later to apply the official patch that fixes this authentication bypass vulnerability. Since the vendor advisory confirms the issue is patched in these versions, applying these updates is the recommended remediation. Patch status is confirmed by the vendor's versioning information.