CVE-2026-94606 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
- 🔗 github.com/goauthentik/authentik/security/advisories…
- 🔗 github.com/goauthentik/authentik/pull/25958
- 🔗 github.com/goauthentik/authentik/pull/25963
- 🔗 github.com/goauthentik/authentik/pull/25968
- 🔗 github.com/goauthentik/authentik/pull/25973
- 🔗 github.com/goauthentik/authentik/commit/01d4349f2aaa…
- 🔗 github.com/goauthentik/authentik/commit/1fcf9868133e…
- 🔗 github.com/goauthentik/authentik/commit/c10ae83ebf8c…
```Code``` unterstützt. Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-09-13 | 2026-09-26 |
|---|---|---|
| ≥90 % | 0 | 497 |
| ≥50 % | 0 | 1467 |
| ≥10 % | 0 | 1 |
| <10 % | 300 | 0 |
CVE-2026-94606 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead
Noch keine Analyse zu CVE-2026-94606
Sei der Erste: Einschätzung, Betroffenheit, Workaround oder PoC — mit Antworten im Thread.