CVE-2026-94611

Received Received - Intake

Information Disclosure in Authentik Identity Provider

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications using a client or shared secret, and applications using a proxy provider. Deployments are affected when view permission is granted to accounts that are not intended to read these credentials; deployments where every viewer is permitted to read them are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-94611

EUVD

EUVD-2026-86277

Affected Vendors & Products

Vendor	Product	Version / Range
goauthentik	authentik	2026.2.7
goauthentik	authentik	2026.5.7
goauthentik	authentik	2026.8.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in authentik allows users with view permissions to see sensitive credentials like client secrets or one-time codes through the API, even if they shouldn't have access. The issue occurs because API serializers return stored credentials when an account has view permission on affected configurations. This affects multiple components including mail/SMS one-time codes, outbound provisioning, device trust integrations, identity sources, Kubernetes outposts, and applications using client secrets or proxy providers.

Detection Guidance

To detect this vulnerability, check if your authentik version is below 2026.2.7, 2026.5.7, or 2026.8.2. Review API responses for exposed credentials in configurations like one-time codes, outbound provisioning, or client secrets. Use commands like `curl` to query the API and inspect responses for sensitive fields.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to access sensitive credentials such as client secrets, one-time codes, or shared secrets. This could lead to account takeovers, data breaches, or unauthorized access to protected systems. The impact depends on whether view permissions were granted to accounts not intended to read these credentials.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing sensitive personal or health information through unauthorized access to credentials. GDPR requires protection of personal data while HIPAA mandates safeguarding protected health information. Unauthorized credential exposure may lead to data breaches, triggering mandatory breach notifications and potential fines.

Mitigation Strategies

Upgrade authentik to versions 2026.2.7, 2026.5.7, or 2026.8.2 or later. Revoke unnecessary view permissions for accounts that should not access sensitive credentials. Review and restrict access to configurations storing secrets.

Hi! I’m here to help you understand CVE-2026-94611. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70