CVE-2026-94606 in authentik
Summary
by MITRE • 09/24/2026
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within authentik prior to the specified patch versions represents a critical flaw in the logic governing multi-factor authentication enrollment for email-based authenticators. Authentik serves as an open-source identity provider that manages user identities and access control, making its integrity paramount for securing single sign-on environments. The core technical deficiency lies in how the system handles recipient addresses during the setup of two-factor authentication factors. Specifically, when a user initiates or completes the enrollment process for an email authenticator within an active authentication flow, the application accepts the destination email address provided directly by the client-side request rather than validating it against the verified identity attributes already established and stored in the session context. This design oversight creates a divergence between the authenticated user's actual identity and the contact method used to deliver security codes, effectively allowing the control of the second factor through input manipulation.
The operational impact of this flaw is severe for organizations relying on authentik as their primary authentication gateway. An attacker who has obtained or guessed a target user's password can exploit this logic error during the enrollment phase. By intercepting and modifying the setup request to specify an email address under the attacker's control, the adversary forces the system to send the one-time verification code to that external destination rather than the legitimate user's registered inbox. Since the vulnerability specifically affects new enrollments where no prior email factor exists, it allows the attacker to bypass existing security controls and establish a persistent foothold. Once the attacker receives the code and completes the enrollment process, they successfully register their own device or access method as an authorized authenticator for that account. This results in full session hijacking capabilities, granting unauthorized access to all single sign-on applications protected by this identity provider without needing further credentials beyond the initial password compromise.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site, although it is more accurately categorized under CWE-359 Exposure of Private Information or CWE-798 Use of Hard-coded Credentials if viewed through the lens of trusting unverified input. In terms of MITRE ATT&CK framework mapping, this behavior facilitates Account Manipulation and Credential Access techniques, specifically allowing an adversary to add additional authentication methods to maintain persistence after initial compromise. The attack vector is primarily remote but requires prior knowledge of a valid user's password, placing it in the category of authenticated attacks that leverage misconfigured trust relationships within the application logic rather than traditional injection or buffer overflow exploits.
Mitigation strategies must prioritize immediate software updates and architectural review. Organizations running affected versions of authentik should upgrade to version 2026.2.7, 2026.5.7, or 2026.8.2 immediately, as these releases contain the necessary code corrections to enforce strict validation of recipient addresses against established session data. Until patches are applied, administrators can implement compensating controls such as disabling email-based multi-factor authentication enrollment for new users and requiring more robust authenticator types like hardware security keys or time-based one-time password applications that do not rely on external communication channels susceptible to interception via input manipulation. Additionally, monitoring logs for unusual patterns in factor enrollment requests where the destination address differs from known user attributes can help detect ongoing exploitation attempts. It is crucial to note that this vulnerability does not affect other authenticator types such as TOTP or hardware keys, so organizations using those methods exclusively are less susceptible to this specific attack path but should still apply updates for overall system integrity and defense in depth.