goauthentik Authentik up to 2026.2.5/2026.5.4 Google Chrome Endpoint Stage improper authentication

Summaryinfo

A vulnerability labeled as critical has been found in goauthentik Authentik up to 2026.2.5/2026.5.4. Affected by this vulnerability is an unknown functionality of the component Google Chrome Endpoint Stage. The manipulation results in improper authentication. This vulnerability is reported as CVE-2026-54730. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in goauthentik Authentik up to 2026.2.5/2026.5.4. Affected is an unknown part of the component Google Chrome Endpoint Stage. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-54730 since 06/16/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 2026.2.6 or 2026.5.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• goauthentik

Name

• Authentik

Version

• 2026.2.0
• 2026.2.1
• 2026.2.2
• 2026.2.3
• 2026.2.4
• 2026.2.5
• 2026.5.0
• 2026.5.1
• 2026.5.2
• 2026.5.3
• 2026.5.4

Website

• Product: https://github.com/goauthentik/authentik/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion