CVE-2026-54730

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.6 authentik versions prior to 2026.5.5

Description In enterprise deployments using a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage, the authentication flow advances without confirming that the out-of-band device attestation was completed. The device attestation process occurs within a verification iframe that interacts with the Google Verified Access API. However, the system treats the flow as successful immediately upon submission of the stage. This allows an attacker to bypass the verification iframe and authenticate using an unverified device. If device trust is the sole additional authentication factor, this protection is completely bypassed, although other active factors remain effective.

Recommendations Update to version 2026.2.6. Update to version 2026.5.5. As a temporary mitigation, avoid using the Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in authentication flows.