CVE-2026-94606: CWE-287: Improper Authentication in goauthentik authentik
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
AI Analysis
Technical Summary
The vulnerability in authentik affects the email authenticator enrollment during authentication or enrollment flows. The system accepts an attacker-supplied recipient email address instead of the verified address associated with the user flow. An attacker with knowledge of the target user's password can exploit this by substituting their own email address to receive the one-time code, enroll the email factor on behalf of the target, and gain authenticated sessions and access to single sign-on applications. The vulnerability does not affect other authenticator types. Fixed in authentik versions 2026.2.7, 2026.5.7, and 2026.8.2.
Potential Impact
Successful exploitation allows an attacker who knows a target user's password to enroll an email authenticator factor with an attacker-controlled email address. This results in the attacker obtaining an authenticated session as the target user, enabling access to single sign-on applications protected by that account. The vulnerability impacts confidentiality and integrity of user sessions and access controls. Other authenticator types remain unaffected.
Mitigation Recommendations
This vulnerability is fixed in authentik versions 2026.2.7, 2026.5.7, and 2026.8.2. Users should upgrade to one of these versions or later to remediate the issue. No other mitigation actions are indicated by the vendor advisory.
CVE-2026-94606: CWE-287: Improper Authentication in goauthentik authentik
Description
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
CVSS v3.1
Score 8.9high
Affected software
goauthentik
authentik
pkg:github/goauthentik/authentikRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in authentik affects the email authenticator enrollment during authentication or enrollment flows. The system accepts an attacker-supplied recipient email address instead of the verified address associated with the user flow. An attacker with knowledge of the target user's password can exploit this by substituting their own email address to receive the one-time code, enroll the email factor on behalf of the target, and gain authenticated sessions and access to single sign-on applications. The vulnerability does not affect other authenticator types. Fixed in authentik versions 2026.2.7, 2026.5.7, and 2026.8.2.
Potential Impact
Successful exploitation allows an attacker who knows a target user's password to enroll an email authenticator factor with an attacker-controlled email address. This results in the attacker obtaining an authenticated session as the target user, enabling access to single sign-on applications protected by that account. The vulnerability impacts confidentiality and integrity of user sessions and access controls. Other authenticator types remain unaffected.
Mitigation Recommendations
This vulnerability is fixed in authentik versions 2026.2.7, 2026.5.7, and 2026.8.2. Users should upgrade to one of these versions or later to remediate the issue. No other mitigation actions are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-21T21:32:23.741Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab550d3f7a7c541068cffc8
Added to database: 09/24/2026, 16:33:23 UTC
Last enriched: 09/24/2026, 16:49:36 UTC
Last updated: 09/25/2026, 02:48:08 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.