CVE-2026-94606

8.9 HIGHpublic exploit available

Published 2026-09-24 · Updated 2026-09-25

AI risk analysis

Summary: The flaw allows an attacker to substitute an email address during the enrollment process, potentially gaining access to the user's account.
Exploitability: Exploitation requires knowledge of the target user's password and the absence of prior email factor enrollment. The attacker must also control the recipient address.
Blast radius: If exploited, the attacker gains access to the user's account and single sign-on applications.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to authentik version 2026.2.7, 2026.5.7, or 2026.8.2.

auth-bypassemailenrollmentidentity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Weaknesses

CWE-287, CWE-807

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.