authentik
Identity · products/authentik.yaml · RSS
Latest 2026.8.5 Oct 21, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 2026.8 | 2026.8.5 | Aug 18, 2026 | — · maintained |
| 2026.5 | 2026.5.8 | May 22, 2026 | — · maintained |
| 2026.2 | 2026.2.7 | Feb 24, 2026 | Aug 18, 2026 · ended |
| 2025.12 | 2025.12.6 | Jan 13, 2026 | May 22, 2026 · ended |
| 2025.10 | 2025.10.4 | Oct 27, 2025 | Feb 24, 2026 · ended |
| 2025.8 | 2025.8.6 | Aug 20, 2025 | Jan 13, 2026 · ended |
| 2025.6 | 2025.6.4 | Jun 3, 2025 | Oct 27, 2025 · ended |
| 2025.4 | 2025.4.4 | Apr 29, 2025 | Aug 20, 2025 · ended |
| 2024.12 | 2024.12.5 | Dec 19, 2024 | Apr 30, 2025 · ended |
| 2023.10 | 2023.10.7 | Oct 26, 2023 | Apr 24, 2024 · ended |
| 2022.12 | 2022.12.3 | Dec 28, 2022 | Feb 14, 2023 · ended |
| 2021.12 | 2021.12.5 | Dec 16, 2021 | Feb 16, 2022 · ended |
Recent releases
breakingweb/user: remove slug display in any display mode on the user application library page (#26441)
securityroot: document CNA in SECURITY.md (#26124)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5
breakingwebsite/docs: 2026.5: remove preview tag from mtls stage doc
securitysecurity: automated internal backport of patch 1822.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch 1817.sec.patch to authentik-2026.5
securitywebsite/docs: document SCIM source trust model and security implications (cherry-pick #22535 to version-2026.5)
breakingpackages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5)
breakingwebsite/docs: remove colons from release notes (cherry-pick #23311 to version-2026.5)
securitywebsite/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5)
securityroot: update security release versions (cherry-pick #22583 to version-2026.5)
securitysecurity: automated internal backport of patch GHSA-c3m2-jqmq-pvp3.sec.patch to authentik-2026.5
securitysecurity: automated internal backport of patch GHSA-wr38-7xg8-fqxr.sec.patch to authentik-2026.5
breakingendpoints: remove print line (cherry-pick #22325 to version-2026.5)
securitywebsite/docs: fix email link in CVE-2026-40166 (cherry-pick #22331 to version-2026.5)
breakingwebsite/integrations: remove sp binding field (cherry-pick #22200 to version-2026.5)
securitysecurity: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2
securitysecurity: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2
Security advisories
8.8 CVE-2026-61574 RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries
8.8 CVE-2026-49443 `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
8.5 CVE-2026-47201 XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
medium CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
8.1 CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
high CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
8.7 GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode