Is authentik 2025.10.4 affected?

Vulnerabilities affecting 2025.10.4

• 9.8
  CVE-2026-49448 SourceStage bypass via empty POST
• 9.3
  CVE-2026-42849 Reflected XSS in SFE
• 9.1
  CVE-2026-25227 Authenticated Remote Code Execution via Policy/Property Mapping test endpoint fixed in 2025.12.4
• 8.9
  CVE-2026-94606 MFA bypass via recipient override in the email authenticator
• 8.8
  CVE-2026-94609 Privilege escalation via delegated group and user management
• 8.8
  CVE-2026-61574 RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries
• 8.8
  CVE-2026-49443 `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
• 8.8
  CVE-2026-25922 Signature Verification bypass in SAML Source Assertion
• 8.7
  CVE-2026-57580 Account Takeover via SAML NameID Comment Truncation
• 8.7
  GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
• 8.7
  CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
• 8.6
  CVE-2026-54730 Google Chrome device trust stages can be bypassed
• 8.6
  CVE-2026-25748 Forward authentication bypass with malformed session cookie on Traefik and Caddy
• 8.5
  CVE-2026-47201 XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
• 8.1
  CVE-2026-94611 Certain stored credentials readable with view permission alone
• 8.1
  CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
• 7.5
  CVE-2026-94613 Denial of Service via Malformed SAML Messages
• 7.4
  CVE-2026-94612 Authentication bypass in SAML Sources via assertion confusion and replay
• 7.4
  GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
• 5.4
  GHSA-hmrg-vpp4-gj88 Broken access control in Shared Signals Framework stream management
• 5.3
  CVE-2026-55106 LDAP Source debug endpoint accessible without authorization
• medium
  CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
• high
  CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/

Newer releases