The vulnerability resides in the Simple Flow Executor's AutosubmitStage within authentik, an open‑source identity provider. An attacker can inject a malicious script that is reflected back into the page each time the AutosubmitStage processes user input. When a victim loads the crafted page, the script runs in the victim’s browser, allowing the attacker to steal session cookies or perform actions on the victim’s behalf, effectively taking over the Identity Provider account. This is a classic reflected XSS flaw as defined by CWE‑79.

The affected product is Authentik released by goauthentik. Versions of authentik prior to 2025.12.5 and prior to 2026.2.3 contain the flaw. All installations running an older release are vulnerable until they are upgraded to the patched versions.

The flaw has a CVSS base score of 9.3, indicating an exploit would provide full control over the victim's authenticated session. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that known exploit activity has not been observed yet. The attack vector is remote, relying on a maliciously crafted URL or embedded link that includes the AutosubmitStage input; an unsuspecting user who follows the link will trigger the reflected XSS. Because the vulnerability is client‑side, it can be exploited with minimal technical effort from the attacker side, but requires that the victim visits the vulnerable page.