Skip to content

security: CVE-2026-25922#20241

Merged
rissson merged 1 commit intomainfrom
int-backport/authentik-main/CVE-2026-25922.sec.patch
Feb 12, 2026
Merged

security: CVE-2026-25922#20241
rissson merged 1 commit intomainfrom
int-backport/authentik-main/CVE-2026-25922.sec.patch

Conversation

@authentik-automation
Copy link
Contributor

@authentik-automation authentik-automation bot commented Feb 12, 2026 •
edited by rissson
Loading

@authentik-automation authentik-automation bot requested a review from a team as a code owner February 12, 2026 14:06
@authentik-automation authentik-automation bot requested a review from a team as a code owner February 12, 2026 14:06
@rissson rissson changed the title internal: Automated internal backport: CVE-2026-25922.sec.patch to authentik-main security: CVE-2026-25922 Feb 12, 2026
@codecov
Copy link

codecov bot commented Feb 12, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 96.15385% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.27%. Comparing base (af36cdc) to head (e11baea).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
authentik/sources/saml/processors/response.py 90.90% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #20241      +/-   ##
==========================================
- Coverage   93.29%   93.27%   -0.03%     
==========================================
  Files         981      981              
  Lines       55030    55051      +21     
==========================================
+ Hits        51342    51347       +5     
- Misses       3688     3704      +16
Flag Coverage Δ
conformance 37.48% <15.38%> (-0.01%) ⬇️
e2e 43.31% <26.92%> (-0.01%) ⬇️
integration 22.42% <7.69%> (-0.06%) ⬇️
unit 91.50% <96.15%> (+<0.01%) ⬆️
unit-migrate 91.54% <96.15%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@netlify
Copy link

netlify bot commented Feb 12, 2026

✅ Deploy Preview for authentik-integrations ready!

Name Link
🔨 Latest commit e11baea
🔍 Latest deploy log https://app.netlify.com/projects/authentik-integrations/deploys/698dde57dbf02a00082bf425
😎 Deploy Preview https://deploy-preview-20241--authentik-integrations.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@netlify
Copy link

netlify bot commented Feb 12, 2026

✅ Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit e11baea
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/698dde56f5867400082f2718
😎 Deploy Preview https://deploy-preview-20241--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@rissson rissson enabled auto-merge (squash) February 12, 2026 14:37
@rissson rissson disabled auto-merge February 12, 2026 14:43
@rissson rissson enabled auto-merge (squash) February 12, 2026 14:45
@rissson rissson merged commit 97b6c95 into main Feb 12, 2026
102 of 103 checks passed
@rissson rissson deleted the int-backport/authentik-main/CVE-2026-25922.sec.patch branch February 12, 2026 14:51
@github-actions
Copy link
Contributor

github-actions bot commented Feb 12, 2026

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-e11baea13631cbb65ddb09f2338247cc8157320d
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-e11baea13631cbb65ddb09f2338247cc8157320d

Afterwards, run the upgrade commands from the latest release notes.

kensternberg-authentik added a commit that referenced this pull request Feb 12, 2026
@kensternberg-authentik
Merge branch 'main' into web/flow/move-dialogs-into-the-light
7c1d1f8 
* main: (59 commits)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ci: fix release testing (#20207)
  core: Apply CSpell corrections. (#20191)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770842608 (#20213)
  core, web: update translations (#20215)
  core: bump library/node from 25.6.0-trixie to 25.6.1-trixie in /website (#20220)
  core: bump google-api-python-client from 2.189.0 to 2.190.0 (#20217)
  core: bump webauthn from 2.7.0 to 2.7.1 (#20218)
  ci: bump docker/build-push-action from 6.18.0 to 6.19.1 (#20221)
  website/integrations: Update Komga instructions to add "email_verified" attribute to "email" claim. (#20135)
  website: Apply CSpell corrections. (#20189)
  providers/saml: send logoutResponse on sp-init logout (#17691)
  website/docs: ssf: update SSF documentation (#20195)
  website/docs: draft of new WS-Fed provider docs  (#20091)
  website/docs: add email verification scope doc (#20141)
  website/docs: correct reference to overriden S3 variable (#20156)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 12, 2026
@kensternberg-authentik
Merge branch 'main' into web/flow/extract-flow-inspector
d8cb305 
* main: (59 commits)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ci: fix release testing (#20207)
  core: Apply CSpell corrections. (#20191)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770842608 (#20213)
  core, web: update translations (#20215)
  core: bump library/node from 25.6.0-trixie to 25.6.1-trixie in /website (#20220)
  core: bump google-api-python-client from 2.189.0 to 2.190.0 (#20217)
  core: bump webauthn from 2.7.0 to 2.7.1 (#20218)
  ci: bump docker/build-push-action from 6.18.0 to 6.19.1 (#20221)
  website/integrations: Update Komga instructions to add "email_verified" attribute to "email" claim. (#20135)
  website: Apply CSpell corrections. (#20189)
  providers/saml: send logoutResponse on sp-init logout (#17691)
  website/docs: ssf: update SSF documentation (#20195)
  website/docs: draft of new WS-Fed provider docs  (#20091)
  website/docs: add email verification scope doc (#20141)
  website/docs: correct reference to overriden S3 variable (#20156)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 13, 2026
@kensternberg-authentik
Merge branch 'main' into web/flow/tablize-token-component-relationshi…
96aafd7 
…p-v3

* main: (105 commits)
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ci: fix release testing (#20207)
  core: Apply CSpell corrections. (#20191)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770842608 (#20213)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 13, 2026
@kensternberg-authentik
Merge branch 'web/flow/tablize-token-component-relationship-v3' into …
2acc605 
…web/flow/tablize-token-component-relationship

* web/flow/tablize-token-component-relationship-v3: (75 commits)
  Removed the cache; it's extra code for no benefit whatsoever; the table is constructed ONCE at start-up, there's never going to be a cache hit.  The FlowExecutorStageFactory produces StageMappings (StageMapping[]), which is itself a warehouse of singular server-component -> client-component relationships, fetching the client from the bundle as needed.  The StageMapping only does the fetch once per instance, so (for example) a password failure will reinstantiate a PasswordStage, but it will not fetch it a second time.
  Tidy.
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ci: fix release testing (#20207)
  ...
kensternberg-authentik added a commit that referenced this pull request Feb 13, 2026
@kensternberg-authentik
Merge branch 'web/flow/tablize-token-component-relationship' into web…
b741094 
…/flow/20030-one-true-api

* web/flow/tablize-token-component-relationship: (76 commits)
  Removed comments about the cache.  Added comments about where to find the FlowExecutor stage table. Moved the import of WebAuthnAuthenticticatorRegisterState from FlowExecutor.ts to FlowExecutorStages.ts; both files are bundled together, so this is a no-op functionally, but it's easier to confirm that StageEntries without import expressions (STageModuleCallbacks) have their stages bundled (pre-imported) if the import statement is in the same file.
  Removed the cache; it's extra code for no benefit whatsoever; the table is constructed ONCE at start-up, there's never going to be a cache hit.  The FlowExecutorStageFactory produces StageMappings (StageMapping[]), which is itself a warehouse of singular server-component -> client-component relationships, fetching the client from the bundle as needed.  The StageMapping only does the fetch once per instance, so (for example) a password failure will reinstantiate a PasswordStage, but it will not fetch it a second time.
  Tidy.
  website/docs: Custom CSS (#19991)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1770992049 (#20285)
  stage/invitation: Send invite via email UI (#19823)
  root: remove unused `django-cte` (#20090)
  core: bump ruff from 0.15.0 to 0.15.1 (#20273)
  core, web: update translations (#20271)
  ci: bump docker/build-push-action from 6.19.1 to 6.19.2 (#20274)
  enterprise/lifecycle: fix multiple reviews showing up in "Reviews" when the user is a member of multiple reviewer groups (#20266)
  ci: fix binary outpost build on release (#20248)
  web: add pretty names for lifecycle review events in event logs (#20264)
  web: fix italic formatting in lifecycle rule help text (#20263)
  website/docs: 2025.8.6 release notes (#20243)
  website/docs: 2025.12.4 release notes (#20226)
  website/docs: 2025.10.4 release notes (#20242)
  security: CVE-2026-25748 (#20240)
  security: CVE-2026-25922 (#20241)
  security: CVE-2026-25227 (#20239)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rissson rissson rissson approved these changes

Assignees

No one assigned

Labels

cherry-pick

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rissson