CVE-2026-42849EPSS p28.3%

CVE-2026-42849CVE-2026-42849

goauthentik / authentik

Description

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.

Scoring

CVSS 9.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS0.36% probability of exploitation · percentile 28.3% · 2026-08-03T12:00:16Z
Last modified2026-07-22

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-49448
CVE
CVE-2026-40165
CVE
CVE-2026-47201
CVE
CVE-2026-25922
CVE
CVE-2026-41569
CVE
CVE-2026-49443
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.