Skip to content

authentik

version/2026.5.3 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

authentication authentik authorization kubernetes oauth2 oauth2-client
+10 more
oauth2-server oidc oidc-client oidc-provider proxy saml saml-idp saml-sp security sso

Affected surfaces

auth deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

Authentik version 2026.5.3 fixes CVE‑2026‑49443 and CVE‑2026‑49448, updating Django to 5.2.15 and addressing multiple bug issues.

Why it matters: CVE severity high (CVSS ≥ 7) – patch immediately if using affected components; Django bump resolves upstream vulnerabilities.

Summary

AI summary

Broad release touches website/docs, tests/e2e, enterprise/providers/scim, and web/admin.

Changes in this release

Security Critical

Marks CVE-2026-49443 and CVE-2026-49448 as fixed.

Marks CVE-2026-49443 and CVE-2026-49448 as fixed.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Low

Polyfills customElements.getName for Safari < 17.4.

Polyfills customElements.getName for Safari < 17.4.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Dependency Low

Bumps Django from 5.2.14 to 5.2.15.

Bumps Django from 5.2.14 to 5.2.15.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fixes Docker outpost integration form CA Cert filter issue.

Fixes Docker outpost integration form CA Cert filter issue.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fixes proxy tests failing due to in‑use port.

Fixes proxy tests failing due to in‑use port.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fixes interactive OAuth overriding refresh_token in SCIM provider.

Fixes interactive OAuth overriding refresh_token in SCIM provider.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fixes exception with invalid auth type in agent connector.

Fixes exception with invalid auth type in agent connector.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fixes panic in RADIUS provider logs due to type mismatch.

Fixes panic in RADIUS provider logs due to type mismatch.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fixes package-lock.json integrity issue.

Fixes package-lock.json integrity issue.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Low

Handles integrity exception when applying blueprints.

Handles integrity exception when applying blueprints.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Full changelog

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202653

What's Changed

  • website/docs: 2026.5.2 release notes (cherry-pick #22721 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22736
  • website/docs: 2026.2.4 release notes (cherry-pick #22720 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22738
  • website/docs: 2025.12.6 release notes (cherry-pick #22719 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22741
  • website/docs: update endpoint SSH docs (cherry-pick #22759 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22793
  • tests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22792
  • enterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22861
  • website/docs: mark cves CVE-2026-49443 and CVE-2026-49448 (cherry-pick #22808 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22864
  • website/docs: add oidc issuer information (cherry-pick #22556 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22800
  • website/docs: update binding wizard labels (cherry-pick #22869 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22872
  • web/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22895
  • blueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22927
  • website/docs: clean up proxy provider docs (cherry-pick #22870 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22890
  • endpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22951
  • providers/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22967
  • website: fix package-lock.json (version-2026.5) by @PeshekDotDev in https://github.com/goauthentik/authentik/pull/22964
  • web/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22963
  • core: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22962
  • providers/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22955
  • website/docs: add release notes for 2026.5.3 (cherry-pick #22976 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/22978

Full Changelog: https://github.com/goauthentik/authentik/compare/version/2026.5.2...version/2026.5.3

Security Fixes

  • Marked CVE-2026-49443 and CVE-2026-49448 in documentation
  • CVE-2026-49448
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track authentik

Get notified when new releases ship.

Sign up free

About authentik

The authentication glue you need.

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]