CVE-2026-94606

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94606

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94606.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94606

Aliases

BIT-authentik-2026-94606
GHSA-qgqp-xh8r-v73r

Published

2026-09-24T16:23:30Z

Modified

2026-10-28T02:30:23Z

Severity

8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L CVSS Calculator

Summary

authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

Details

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-287",
        "CWE-807"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94606.json"
}

References

Affected packages

Git / github.com/goauthentik/authentik

Affected ranges

Type

GIT

Repo

https://github.com/goauthentik/authentik

Events

Introduced

Fixed

0936c5b0ce31dc98f5f9eb4b06730a13f6da0333

Introduced

7a71bcfcdc442204b8985ab379b22f7eb9fe321f

Fixed

71d3c21110023b914232d75b6c9089f472e2f73c

Introduced

f3753ec20ce13ef672401a131379d1a5a2d3439b

Fixed

dce85a5b64a429206199e9ffddc602060643f17a

Fixed

01d4349f2aaa9beda532f92e2a251a17fefee9b3

Fixed

1fcf9868133e5d05e266edbc1f6f3ee972baa3f9

Fixed

c10ae83ebf8c61de2f1922edf1fab504d9f3b06f

Fixed

ec41732339726fba477182c0906a8d930b145beb

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2026.2.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "2026.5.0"
                },
                {
                    "fixed": "2026.5.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "2026.8.0"
                },
                {
                    "fixed": "2026.8.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "01d4349f2aaa9beda532f92e2a251a17fefee9b3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "1fcf9868133e5d05e266edbc1f6f3ee972baa3f9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "c10ae83ebf8c61de2f1922edf1fab504d9f3b06f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "ec41732339726fba477182c0906a8d930b145beb"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

version/0.*

version/0.0.10-alpha

version/0.0.11-alpha

version/0.0.12-alpha

version/0.0.13-alpha

version/0.0.2-alpha

version/0.0.3-alpha

version/0.0.4-alpha

version/0.0.5-alpha

version/0.0.6-alpha

version/0.0.7-alpha

version/0.0.8-alpha

version/0.0.9-alpha

version/0.1.0-beta

version/0.1.1-beta

version/0.1.10-beta

version/0.1.11-beta

version/0.1.12-beta

version/0.1.13-beta

version/0.1.14-beta

version/0.1.15-beta

version/0.1.16-beta

version/0.1.17-beta

version/0.1.18-beta

version/0.1.19-beta

version/0.1.2-beta

version/0.1.20-beta

version/0.1.21-beta

version/0.1.22-beta

version/0.1.23-beta

version/0.1.24-beta

version/0.1.25-beta

version/0.1.26-beta

version/0.1.27-beta

version/0.1.28-beta

version/0.1.29-beta

version/0.1.3-beta

version/0.1.30-beta

version/0.1.31-beta

version/0.1.32-beta

version/0.1.33-beta

version/0.1.34-beta

version/0.1.35-beta

version/0.1.36-beta

version/0.1.37-beta

version/0.1.38-beta

version/0.1.4-beta

version/0.1.5-beta

version/0.1.6-beta

version/0.1.7-beta

version/0.1.8-beta

version/0.1.9-beta

version/0.10.0-rc1

version/0.10.0-rc2

version/0.10.0-rc3

version/0.10.0-rc4

version/0.10.0-rc5

version/0.10.0-rc6

version/0.10.0-stable

version/0.10.1-stable

version/0.10.2-stable

version/0.10.3-stable

version/0.10.4-stable

version/0.10.5-stable

version/0.10.6-stable

version/0.10.7-stable

version/0.10.8-stable

version/0.10.9-stable

version/0.11.0-stable

version/0.12.0-stable

version/0.12.1-stable

version/0.12.10-stable

version/0.12.11-stable

version/0.12.2-stable

version/0.12.3-stable

version/0.12.4-stable

version/0.12.5-stable

version/0.12.6-stable

version/0.12.7-stable

version/0.12.8-stable

version/0.12.9-stable

version/0.13.0-rc1

version/0.13.0-rc2

version/0.13.0-rc3

version/0.13.0-rc4

version/0.13.0-stable

version/0.13.1-stable

version/0.13.2-stable

version/0.13.3-stable

version/0.2.0-beta

version/0.2.1-beta

version/0.2.2-beta

version/0.2.3-beta

version/0.2.4-beta

version/0.2.5-beta

version/0.2.6-beta

version/0.2.7-beta

version/0.2.8-beta

version/0.3.0-beta

version/0.4.0-beta

version/0.4.1-beta

version/0.4.2-beta

version/0.5.0-beta

version/0.6.0-beta

version/0.6.1-beta

version/0.6.2-beta

version/0.6.3-beta

version/0.7.0-beta

version/0.7.1-beta

version/0.7.10-beta

version/0.7.11-beta

version/0.7.12-beta

version/0.7.13-beta

version/0.7.14-beta

version/0.7.15-beta

version/0.7.16-beta

version/0.7.17-beta

version/0.7.2-beta

version/0.7.3-beta

version/0.7.4-beta

version/0.7.5-beta

version/0.7.6-beta

version/0.7.7-beta

version/0.7.8-beta

version/0.7.9-beta

version/0.8.0-beta

version/0.8.1-beta

version/0.8.10-beta

version/0.8.11-beta

version/0.8.12-beta

version/0.8.14-beta

version/0.8.15-beta

version/0.8.2-beta

version/0.8.3-beta

version/0.8.4-beta

version/0.8.5-beta

version/0.8.6-beta

version/0.8.7-beta

version/0.8.8-beta

version/0.8.9-beta

version/0.9.0-pre1

version/0.9.0-pre2

version/0.9.0-pre3

version/0.9.0-pre4

version/0.9.0-pre5

version/0.9.0-pre6

version/0.9.0-pre7

version/0.9.0-rc1

version/0.9.0-rc2

version/0.9.0-stable

version/2021.*

version/2021.1.1-rc1

version/2021.1.1-rc2

version/2021.1.1-stable

version/2021.1.2-stable

version/2021.1.3-stable

version/2021.10.1-rc3

version/2021.10.3

version/2021.10.4

version/2021.12.1

version/2021.12.1-rc1

version/2021.12.1-rc2

version/2021.12.1-rc3

version/2021.12.1-rc4

version/2021.12.1-rc5

version/2021.12.2

version/2021.12.3

version/2021.12.4

version/2021.12.5

version/2021.2.2-stable

version/2021.2.3-stable

version/2021.3.1

version/2021.3.1-rc1

version/2021.3.1-rc2

version/2021.3.2

version/2021.3.3

version/2021.3.4

version/2021.4.1

version/2021.4.1-rc1

version/2021.4.1-rc2

version/2021.5.1

version/2021.5.1-rc10

version/2021.5.1-rc8

version/2021.5.1-rc9

version/2021.5.2

version/2021.6.1

version/2021.6.1-rc1

version/2021.6.1-rc2

version/2021.6.1-rc3

version/2021.6.1-rc4

version/2021.6.3

version/2021.6.4

version/2021.7.1

version/2021.7.1-rc1

version/2021.8.1

version/2021.8.1-rc2

version/2021.8.2

version/2021.8.3

version/2021.8.4

version/2021.9.1

version/2021.9.1-rc1

version/2021.9.1-rc2

version/2021.9.1-rc3

version/2021.9.2

version/2021.9.3

version/2022.*

version/2022.1.1

version/2022.1.3

version/2022.1.4

version/2022.10.1

version/2022.12.0

version/2022.12.1

version/2022.2.1

version/2022.3.3

version/2022.4.1

version/2022.5.1

version/2022.5.2

version/2022.6.2

version/2022.7.2

version/2022.8.1

version/2022.8.2

version/2022.9.0

version/2023.*

version/2023.10.0

version/2023.2.1

version/2023.5.1

version/2023.6.0

version/2023.8.0

version/2023.8.1

version/2023.8.2

version/2026.*

version/2026.2.0

version/2026.2.0-rc1

version/2026.2.0-rc2

version/2026.2.0-rc3

version/2026.2.0-rc4

version/2026.2.0-rc5

version/2026.2.1

version/2026.2.1-rc1

version/2026.2.2

version/2026.2.2-rc1

version/2026.2.2-rc2

version/2026.2.2-rc3

version/2026.2.3

version/2026.2.3-rc1

version/2026.2.4

version/2026.2.5

version/2026.2.6

version/2026.5.0

version/2026.5.2

version/2026.5.3

version/2026.5.4

version/2026.5.5

version/2026.5.6

version/2026.8.0

version/2026.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94606.json"