The vulnerability allows an attacker who has access to the authentication flow to bypass the Google Chrome device‑trust verification. The ensued device tracking iframe, which normally confirms that the client device has run a Google Verified Access attestation, is ignored, so the stage is treated as passed immediately. If device trust is the sole additional factor, the attacker can authenticate as if the device had been verified, compromising confidentiality of privileged resources dependent on that factor. The weakness is an improper authorization control (CWE‑284) combined with insufficient input validation or configuration checks (CWE‑807).

The flaw exists in the open‑source authentik identity provider. Any deployment using versions earlier than 2026.2.6 or 2026.5.5 that incorporates a Google Chrome Endpoint stage set to REQUIRED, or the deprecated Google Chrome Device Trust Connector stage, is vulnerable. The vendor referenced is goauthentik:authentik, and the affected releases are all those before the 2026.2.6 or 2026.5.5 releases, which fixed the issue.

The CVSS score of 8.6 indicates high severity. No EPSS data is available, but the issue is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited. However, the likely attack vector is an attacker reaching the vulnerable stage after primary username and password authentication, either directly or by manipulating the flow. The attacker can skip the verification iframe and sign in from an unverified device, effectively bypassing device‑trust protection while other factors, if present, remain enforced. The vulnerability size is significant if device trust is the last line of defense, as the authentication flow can be entirely subverted.