CVE-2026-42849CWE-79

authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

Critical · published June 2, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-02T20:30Z
EPSS history
Timeline
  • 02 JUN 20:30Z
    authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
    cvelistv5