sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-25748 authentik has a forward authentication bypass with broken cookie

High 8.6 Published Updated

Attackers can bypass authentication in authentik Proxy Provider using a malformed cookie when integrated with Traefik or Caddy.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2026-25748?

CVE-2026-25748 is a high-severity authentication bypass vulnerability in goauthentik authentik, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific X-Authentik-* headers were set which depending on application can grant access to an attacker. authentik 2025.10.4 and 2025.12.4 fix this issue.

Weakness: CWE-287

Which versions are affected by CVE-2026-25748?

1 open source package ship an affected version, including authentik. It affects 1 product.

PackageAffectedFixed in
authentik BitnamiFrom 2025.10.02025.12.4

Products include Goauthentik Authentik.

How do I fix CVE-2026-25748?

Upgrade authentik to 2025.12.4 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-25748 being exploited?

There is no known exploitation of CVE-2026-25748 in the wild and no public exploit code.

Sources

Also known as BIT-authentik-2026-25748, GHSA-fj56-5763-j8pp.

Is CVE-2026-25748 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free