CVE-2026-25227
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker with specific permissions to run arbitrary code on the authentik server, potentially taking control of the system. It affects versions from 2021.3.1 up to just before 2025.8.6, 2025.10.4, and 2025.12.4, and requires the attacker to have permission to view certain property mappings or policies.
Technical Description
authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Feb 12, 2026
8 days ago
Last Modified
Feb 19, 2026
1 day ago
Vendor
goauthentik
Product
authentik
Related Vulnerabilities
An attacker can inject a harmful authentication message into the authentik identity provider, potentially allowing them to impersonate a legitimate user. This can happen if the system is configured to verify the signature of the assertion but not the response, or if it lacks proper encryption settings.
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to systems using the authentik identity provider when it is set up with certain reverse proxies like Traefik or Caddy. This can happen if the attacker sends a specially crafted cookie, allowing them to access resources without proper credentials, but it only affects versions prior to the specified updates.