A flaw in authentik, an open‑source identity provider, allows the Source stage to be bypassed by submitting a POST request with an empty payload. This bypass removes the normal authentication requirement, enabling an attacker to obtain access to the system without credentials. The vulnerability is a classic example of Broken Authentication (CWE‑287) and can potentially compromise all data protected by the identity provider because it grants unauthorized control of user sessions.

The issue affects the goauthentik:authentik product in all releases prior to 2025.12.6, 2026.2.4, and 2026.5.1. Those specific versions include the vulnerable Source stage code and have since been patched in the mentioned releases.

With a CVSS score of 9.8 the flaw is classified as critical. The EPSS score is not available but the vulnerability involves a remote “empty POST” attack that can be performed over the network, suggesting a high likelihood of exploitation. It is not listed in CISA’s KEV catalog. An attacker can exploit the weakness by sending an empty POST to the Source stage endpoint, bypassing authentication and gaining unauthorized access to the identity provider. No additional prerequisites are disclosed in the advisory, implying the vector is straightforward for anyone with network reach to the authentication service.