authentik

version/2026.5.5 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 11d Secrets & Credentials

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 5 known CVEs

Topics

authentication authentik authorization kubernetes oauth2 oauth2-client

+10 more

oauth2-server oidc oidc-client oidc-provider proxy saml saml-idp saml-sp security sso

ReleasePort's take

Moderate signal

editorial:auto 11d

Authentik 2026.5.5 backports several critical security patches (1822, 1817, 1887, 1919, 1934).

Why it matters: The release includes five high‑severity security fixes; operators running authentik versions affected by these CVEs must upgrade immediately to mitigate risk.

Summary

AI summary

Updates affect tests/openid_conformance, endpoints, web/flows and UI, docs, SCIM, search, OAuth sources, Django broker, plus multiple security patches.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Backported multiple security patches (1822, 1817, 1887, 1919, 1934) to authentik-2026.5. Backported multiple security patches (1822, 1817, 1887, 1919, 1934) to authentik-2026.5. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Added number and boolean support in AKQL queries on JSON fields. Added number and boolean support in AKQL queries on JSON fields. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix
Bugfix	Medium	Fixed race condition in continuous login and added source stage support to authentication flows. Fixed race condition in continuous login and added source stage support to authentication flows. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixed table refresh button not refreshing table data in the web UI. Fixed table refresh button not refreshing table data in the web UI. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Improved error display when SCIM errors do not conform to the SCIM schema. Improved error display when SCIM errors do not conform to the SCIM schema. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixed Log Viewer Intersection Observer issue in the web UI. Fixed Log Viewer Intersection Observer issue in the web UI. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixed ungrammatical expiry time wording in password reset email templates. Fixed ungrammatical expiry time wording in password reset email templates. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Handled exceptions in connector controller sync setup to prevent crashes. Handled exceptions in connector controller sync setup to prevent crashes. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixed discover running repeatedly for each page in outgoing sync. Fixed discover running repeatedly for each page in outgoing sync. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Closed unusable PostgreSQL connections in django‑dramatiq‑postgres broker. Closed unusable PostgreSQL connections in django‑dramatiq‑postgres broker. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

See https://docs.goauthentik.io/docs/releases/2026.5#fixed-in-202655

What's Changed

tests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23834
endpoints: handle exception in connector controller sync setup (cherry-pick #23852 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23854
web/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.5) by @GirlBossRush in https://github.com/goauthentik/authentik/pull/23558
web: fix table refresh button not refreshing table data (cherry-pick #23780 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23878
web/admin: licensing: add usage totals (cherry-pick #23665 to version-2026.5) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/23668
web: Fix Log Viewer Intersection Observer. (cherry-pick #23861 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23949
stages/email: fix ungrammatical expiry time in password reset templates (cherry-pick #22758 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23952
website/docs: cleanup 07-12: update integration routes (cherry-pick #23960 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23975
website/docs: cleanup 07-12: update documentation URLs (cherry-pick #23961 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23976
website/docs: cleanup 07-12: fix Admin interface tab label (cherry-pick #23965 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23982
providers/scim: improve error display when error doesn't conform to scim schema (cherry-pick #23955 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/23957
lib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24019
website/docs: 2026.5: remove preview tag from mtls stage doc by @dominic-r in https://github.com/goauthentik/authentik/pull/23981
api/search: add number and boolean support in AKQL queries on JSON fields (#23418) (cherry-pick #24028 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24033
sources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24020
packages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24035
security: automated internal backport of patch 1822.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/24059
security: automated internal backport of patch 1817.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/24058
security: automated internal backport of patch 1887.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/24060
security: automated internal backport of patch 1919.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/24061
security: automated internal backport of patch 1934.sec.patch to authentik-2026.5 by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/24062
website/docs: release notes for 2026.2.6 (cherry-pick #24069 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24071
website/docs: release notes for 2026.5.5 (cherry-pick #24070 to version-2026.5) by @authentik-cherry-pick[bot] in https://github.com/goauthentik/authentik/pull/24073

Full Changelog: https://github.com/goauthentik/authentik/compare/version/2026.5.4...version/2026.5.5

Security Fixes

Automated internal backport of security patch 1822.sec.patch
Automated internal backport of security patch 1817.sec.patch
Automated internal backport of security patch 1887.sec.patch
Automated internal backport of security patch 1919.sec.patch
Automated internal backport of security patch 1934.sec.patch

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track authentik

Get notified when new releases ship.

About authentik

The authentication glue you need.

All releases →