Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
goauthentik authentik — authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U H H H 8.8 .0030 22.5 —
AFFECTED
Product Versions Fixed
authentik < 2025.12.6 – —
TIMELINE
May 30 Reserved by GitHub_M
Jun 2 EXPLOIT PUBLISHED — CVE-2026-49443 (goauthentik authentik). Public exploit reference added.
Jun 2 Published (CNA: GitHub_M)
Description
authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| May 30, 2026 | Reserved | Reserved by GitHub_M |
| June 2, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-49443 (goauthentik authentik). Public exploit reference added. |
| June 2, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| goauthentik | authentik | — | < 2025.12.6 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-49443 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.