The vulnerability allows any authenticated user to retrieve a full list of all configured remote endpoints, including host information and stored credentials, regardless of the user's application permissions. By reading this list, the attacker can initiate connections to endpoints that belong to other applications, effectively bypassing access controls. This leads to disclosure of sensitive authentication data and grants interactive remote access to systems that the user was not originally authorized to reach.

The flaw exists in the open‑source identity provider authentik by goauthentik in all deployments using the built‑in Remote Access Control (RAC) component before version 2026.2.6 and before 2026.5.5. Versions that have not adopted the enterprise RAC provider are not impacted. All affected instances use the goauthentik product.

The CVSS score of 8.8 classifies this as a high‑severity flaw, and although the EPSS score is not available, the lack of additional mitigations suggests a notable risk for exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the authentik system; once authenticated, the endpoint listing endpoint can be queried to enumerate all endpoints. No additional environmental constraints are documented, so the attack vector is inferred to be authenticated remote access.