CVE-2026-42849

CRITICAL

authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

Title source: cna
STIX 2.1

Description

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.

References (1)

Core 1
Core References

Scores

CVSS v3 9.3
EPSS 0.0032
EPSS Percentile 23.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
goauthentik/authentik < 2025.12.5 (2 CPE variants)
goauthentik/authentik < 2026.2.3
Published Jun 02, 2026
Tracked Since Jun 03, 2026