VULNERABILITY INTELLIGENCE

CVE-2026-42849

CVSS score9.3 CRITICAL
EPSS probability0.33%
CISA KEVNot currently listed
Published2026-06-02
Last modified2026-07-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Description

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references