CVE-2026-25748
Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific X-Authentik-* headers were set which depending on application can grant access to an attacker. authentik 2025.10.4 and 2025.12.4 fix this issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.62% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- goauthentik/authentik
- Source
- security-advisories@github.com
References
- https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4Product, Release Notes
- https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4Product, Release Notes
- https://github.com/goauthentik/authentik/security/advisories/GHSA-fj56-5763-j8ppVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.