CVE-2026-94606

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.7 authentik versions prior to 2026.5.7 authentik versions prior to 2026.8.2

Description During an authentication or enrollment flow, the email authenticator accepts a recipient address provided in the setup request rather than using the address established by the flow. An actor with knowledge of a target user's password can substitute an attacker-controlled address to receive the one-time code and complete the factor enrollment as the target user, provided the target has not already enrolled the email factor. This allows the actor to obtain a session as the target and gain access to single sign-on applications associated with the account.

Recommendations Update to version 2026.2.7. Update to version 2026.5.7. Update to version 2026.8.2.