authentik, an open-source identity provider, contains a critical vulnerability that allows attackers with the ability to modify source connections to log into any account. The flaw affects versions prior to 2025.12.6, 2026.2.4, and 2026.5.1. An attacker needs access to change source connection settings and an account in one of the configured sources to exploit this vulnerability. This represents a complete authentication bypass that could compromise all user accounts in the system. The vulnerability has been patched in the specified versions.