Authentik, an open‑source identity provider, is vulnerable to a forward authentication bypass. When a cookie is malformed, the authentik Proxy Provider used with Traefik or Caddy does not populate the required X-Authentik-* headers. This flaw allows an attacker to successfully authenticate without possessing valid credentials, thereby gaining potentially full application access. The weakness is a credential management flaw (CWE‑287).

All installations of authentik before versions 2025.10.4 and 2025.12.4 that employ forward authentication with a Traefik or Caddy reverse proxy are affected. These older releases do not enforce proper cookie validation before setting the authentication headers. Updated releases starting with 2025.10.4 and 2025.12.4 contain the fix.

The vulnerability scores a CVSS of 8.6, indicating high severity. Its EPSS score is below 1 %, suggesting a low yet non‑zero likelihood of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. An attacker only needs to craft a malicious cookie and send it to the proxy; no additional privileges are required. If successful, the attacker can take over the application session and bypass normal security controls.