https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T10:35:41.201094+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-49443 CVE-2026-49443 — authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API 2026-10-05T10:35:41.217708+00:00

Affected: goauthentik authentik

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.