CVE-2026-49448: authentik: SourceStage bypass via empty POST

Synopsis

An authentication-bypass vulnerability exists in authentik, an open-source identity provider. The flaw is reachable over the network with no credentials required and no user interaction needed, allowing an attacker to skip the Source stage entirely by sending an empty HTTP POST request. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment fix versions are confirmed upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the authentik service via HTTP/HTTPS.

• AuthenticationNot required

  No credentials of any kind are needed; the bypass works against the unauthenticated Source stage flow.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploit complexity is low: the attack requires only an empty POST request and is reliable without any race conditions or special environmental prerequisites.

Blast Radius

• A successful attacker bypasses identity verification entirely, gaining unauthorized access to accounts or sessions protected by the Source stage.
• With full integrity impact, the attacker can create, modify, or delete identity records, OAuth tokens, or provider configurations.
• With full confidentiality impact, the attacker reads stored credentials, session tokens, user profile data, and any secrets managed by the identity provider.
• With full availability impact, the attacker disrupts or crashes the authentication service, blocking legitimate users from logging in.