Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0252

NIXPKGS-2026-0252
published on 15 Feb 2026
Permalink CVE-2026-25748
updated 3 weeks ago by @LeSuisse Activity log
  • Created automatic suggestion 3 weeks, 3 days ago
  • @LeSuisse removed
    3 packages
    • authentik-outposts.ldap
    • authentik-outposts.proxy
    • authentik-outposts.radius
    3 weeks ago
  • @LeSuisse accepted 3 weeks ago
  • @LeSuisse published on GitHub 3 weeks ago
authentik has a forward authentication bypass with broken cookie

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific X-Authentik-* headers were set which depending on application can grant access to an attacker. authentik 2025.10.4 and 2025.12.4 fix this issue.

References

Affected products

authentik
  • ==>= 2025.10.0-rc1, < 2025.12.4
  • ==>= 2025.10.0-rc1, < 2025.10.4

Matching in nixpkgs

Package maintainers

Upstream advisory: https://github.com/goauthentik/authentik/security/advisories/GHSA-fj56-5763-j8pp