Authentik, an open‑source identity provider, has a flaw in its email authenticator enrollment flow. Prior to releases 2026.2.7, 2026.5.7, and 2026.8.2, the component accepts a recipient address supplied in the setup request instead of the address already bound to the authentication flow. An attacker who knows a victim’s password can supply a spoofed email address, receive the one‑time code, and finish enrolling the factor as the victim. The attacker then obtains a session that has the same level of access as the target, granting them access to all SSO applications. This bypass does not affect other authenticator types.

All versions of goauthentik’s authentik released before 2026.2.7, 2026.5.7, or 2026.8.2 are affected. The vulnerability is confined to the email authenticator component; other MFA methods are not impacted.

The CVSS score of 8.9 classifies the issue as high severity. The attack requires knowledge of the victim’s password and the ability to construct a specific enrollment request, which limits the attack surface. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploits at this time. Nevertheless, the potential for complete account takeover warrants immediate attention.