CVE-2026-49443: authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

Synopsis

This is an authentication bypass vulnerability in authentik, an open-source identity provider. An authenticated attacker with a low-privilege account and the ability to modify a source connection can reassign the `UserSourceConnection.user` or `GroupSourceConnection.group` fields through the API, then use that manipulated connection to authenticate as any other account in the system. Successful exploitation gives the attacker full access to any target account, including reading, modifying, and disrupting data or services associated with that account. Patched-image rebuilds at versions 2025.12.6, 2026.2.4, and 2026.5.1 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The authentik API must be reachable over the network; an attacker sends crafted API requests from a remote host to manipulate source connection records.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account in one of the configured sources; any ordinary user account is sufficient to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker operates entirely through their own API calls.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race condition, memory layout dependency, or special environmental state is required beyond having an account and API access.

Blast Radius

• Reads the full session and profile data of any account in the authentik instance, including credentials, tokens, and group memberships.
• Modifies account settings, group assignments, and application permissions for any user the attacker impersonates.
• Disrupts services that rely on authentik for authentication by locking out or altering the accounts of legitimate users.
• Provides a pivot point for lateral movement into any downstream application that trusts authentik as its identity provider.