CVE-2026-94606 Details

A vulnerability exists in authentik, an open-source identity provider, in versions prior to 2026.2.7, 2026.5.7, and 2026.8.2. During the email authenticator enrollment process, the system accepts a recipient address provided in the setup request instead of the one already established by the flow. This flaw allows an actor who knows a target user's password to replace the email address with one controlled by the actor, receive the one-time code, and complete the enrollment for the target user. The vulnerability is only exploitable if the target has not already enrolled the email factor. Successful exploitation grants the actor a session as the target user and access to single sign-on applications associated with the account.

Users can upgrade to authentik versions 2026.2.7, 2026.5.7, or 2026.8.2, where this vulnerability has been fixed.