authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) i…

Published:

1 juni 2026 om 22:00:00

Alert date:

2 juni 2026 om 22:02:38

Source:

nvd.nist.gov

Identity & Access, Web Technologies

authentik, an open-source identity provider, contains a Cross-Site Scripting (XSS) vulnerability in the AutosubmitStage component of the Simple Flow Executor (SFE). The vulnerability exists in versions prior to 2025.12.5 and 2026.2.3 and was introduced to improve compatibility with legacy browsers. The XSS exploit can be triggered through the AutosubmitStage implementation. The vulnerability has been patched in versions 2025.12.5 and 2026.2.3.

Technical details

Mitigation steps:

Affected products:

authentik