CVE-2026-94606

Deferred Deferred - Pending Action

Email Factor Enrollment Spoofing in Authentik

Publication date: 2026-09-24

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-05

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-94606

EUVD

EUVD-2026-86280

Affected Vendors & Products

Vendor	Product	Version / Range
goauthentik	authentik	2026.5.7
goauthentik	authentik	2026.8.2
goauthentik	authentik	to 2026.2.7 (exc)
goauthentik	authentik	to 2026.5.7 (exc)
goauthentik	authentik	to 2026.8.2 (exc)
goauthentik	authentik	2026.2.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an MFA bypass in the email authenticator stage of the authentik authentication system. An attacker who knows a user's password can manipulate the email recipient address during the authentication flow to receive the one-time code instead of the legitimate user. This occurs because the system previously allowed the email address in the request to override the address established by the flow, enabling unauthorized access if the user had not yet enrolled the email authenticator.

Detection Guidance

This vulnerability can be detected by checking the authentik version in use. If your system runs versions prior to 2026.2.7, 2026.5.7, or 2026.8.2, it is vulnerable. Use commands like 'docker ps' or 'kubectl get pods' to inspect running containers, then check version tags or logs for authentik.

Impact Analysis

If exploited, an attacker gains full access to the victim's account and any associated single sign-on applications. The attacker only needs the victim's password and must manipulate the email recipient during MFA setup before the victim has enrolled the email authenticator.

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts, potentially exposing sensitive personal data. For GDPR, this may violate principles of data protection and user consent. For HIPAA, it could compromise protected health information if healthcare data is involved. Organizations using affected authentik versions may face compliance violations due to insufficient authentication controls.

Mitigation Strategies

Upgrade authentik to version 2026.2.7, 2026.5.7, or 2026.8.2 or later. No workarounds exist, so patching is required. Verify the upgrade by checking the version in the admin interface or logs.

Hi! I’m here to help you understand CVE-2026-94606. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70