CVE-2026-42849: authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

Synopsis

Reflected cross-site scripting (XSS) in authentik's Simple Flow Executor (SFE) AutosubmitStage allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted link. Because the vulnerability carries a Changed scope in its CVSS vector, the injected script runs in the context of the authentik identity provider origin, giving an attacker full access to the victim's authenticated session. Successful exploitation enables account takeover of the identity provider account, exposure of stored credentials and tokens, and unauthorized modification of identity data. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream fix versions are published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious payload over the network by directing a victim to a crafted URL targeting the publicly reachable authentik SFE endpoint.

• AuthenticationNot required

  No account or credentials are needed; the attacker exploits the AutosubmitStage before any authentication barrier is reached.

• Victim interactionRequired

  The victim must follow a crafted link or otherwise load the malicious URL in their browser, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or special environmental state are required.

Blast Radius

• Attacker executes arbitrary JavaScript in the victim's browser under the authentik identity provider origin, stealing session tokens and authentication cookies.
• Hijacked session grants full control of the victim's IDP account, including the ability to modify linked applications, credentials, and group memberships.
• Stored OAuth tokens and OpenID Connect grants accessible to the compromised session are exposed and can be exfiltrated.
• Because authentik acts as an upstream identity provider, account takeover can cascade to every downstream application that trusts it for authentication.