CVE-2026-49448: authentik: SourceStage bypass via empty POST
Versions of authentik before 2025.12.6, from 2026.2.0 up to but not including 2026.2.4, and from 2026.5.0 up to but not including 2026.5.1 are affected by a bypass of the Source stage through an empty POST request, according to the GitHub advisory. The record classifies the issue as CWE-287 (Improper Authentication) with a CVSS base score of 9.8 and lists patched versions 2025.12.6, 2026.2.4 and 2026.5.1. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Overview
The CVE describes a flaw in the Source stage of authentik, an open-source identity provider, where sending an empty POST request can bypass the stage. The weakness is classified as CWE-287, Improper Authentication. The upstream advisory is published on GitHub and the record is listed in NVD.
Impact
The record reports a CVSS base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, no privileges or user interaction required, and high impact on confidentiality, integrity and availability. The SSVC entry in the record lists technical impact as total and automatable as yes. These values come from the record and should be validated against the vendor's own assessment.
Affected products and versions
The record lists Goauthentik Authentik with the following ranges:
- before 2025.12.6
- from 2026.2.0 up to but not including 2026.2.4
- from 2026.5.0 up to but not including 2026.5.1
The patched versions named in the description are 2025.12.6, 2026.2.4 and 2026.5.1.
Exploitation status
The CVE is not listed in CISA KEV, so this analysis does not state active exploitation. No confirmed exploitation appears in the sources consulted. The record's SSVC field gives an exploitation value of poc, which indicates proof-of-concept activity, and the GitHub advisory is tagged as containing exploit-related material. Neither point establishes exploitation in the wild.
Remediation and mitigation
- Upgrade to 2025.12.6 or later within the 2025.12 line, to 2026.2.4 or later within the 2026.2 line, or to 2026.5.1 or later within the 2026.5 line.
- Review the vendor advisory for any interim workarounds before patching.
- Restrict network exposure of authentik administrative and flow endpoints where operationally possible until patches are applied.
Detection guidance
- Review authentication flow logs for Source stage requests that complete without the expected prior steps or with unusually empty request bodies.
- Correlate successful authentications with the presence of unexpected session creation during Source stage processing.
- Confirm the running authentik version against the affected ranges listed above.
Limitations of the available information
The record does not provide a detailed technical description of the bypass, the exact request conditions, or any observed incidents. The fixed-version field in the record is empty, so the patched versions are taken from the description and the affected-range data. Whether deployments with custom flows or sources are affected in different ways is unknown.
Frequently asked questions
Which authentik versions are affected by CVE-2026-49448?
The record lists versions before 2025.12.6, from 2026.2.0 up to but not including 2026.2.4, and from 2026.5.0 up to but not including 2026.5.1.
Is this CVE being actively exploited?
The CVE is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted. The record's SSVC field indicates proof-of-concept status only.
What should administrators do first?
Upgrade to 2025.12.6, 2026.2.4 or 2026.5.1 depending on the release line in use, and review Source stage authentication logs for anomalies.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.