CVE-2026-54730

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54730", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:07:33.232Z", "datePublished": "2026-08-18T16:55:29.771Z", "dateUpdated": "2026-08-18T17:21:10.123Z"}, "containers": {"cna": {"title": "authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-807", "lang": "en", "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx"}, {"name": "https://github.com/goauthentik/authentik/pull/24053", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/pull/24053"}, {"name": "https://github.com/goauthentik/authentik/pull/24058", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/pull/24058"}, {"name": "https://github.com/goauthentik/authentik/commit/27866a94f29d0d7f784b3c462a697a968d3f6b9c", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/27866a94f29d0d7f784b3c462a697a968d3f6b9c"}, {"name": "https://github.com/goauthentik/authentik/commit/85adb0bbbd7ad4f2807ec21cf25bb42aee81afbc", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/85adb0bbbd7ad4f2807ec21cf25bb42aee81afbc"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5"}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"version": "< 2026.2.6", "status": "affected"}, {"version": ">= 2026.5.0, < 2026.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T16:55:29.771Z"}, "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5."}], "source": {"advisory": "GHSA-3v9h-3hrm-29cx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T17:18:38.520288Z", "id": "CVE-2026-54730", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T17:21:10.123Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54730", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:07:33.232Z", "datePublished": "2026-08-18T16:55:29.771Z", "dateUpdated": "2026-08-18T17:21:10.123Z"}, "containers": {"cna": {"title": "authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-807", "lang": "en", "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx"}, {"name": "https://github.com/goauthentik/authentik/pull/24053", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/pull/24053"}, {"name": "https://github.com/goauthentik/authentik/pull/24058", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/pull/24058"}, {"name": "https://github.com/goauthentik/authentik/commit/27866a94f29d0d7f784b3c462a697a968d3f6b9c", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/27866a94f29d0d7f784b3c462a697a968d3f6b9c"}, {"name": "https://github.com/goauthentik/authentik/commit/85adb0bbbd7ad4f2807ec21cf25bb42aee81afbc", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/commit/85adb0bbbd7ad4f2807ec21cf25bb42aee81afbc"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6"}, {"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5"}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"version": "< 2026.2.6", "status": "affected"}, {"version": ">= 2026.5.0, < 2026.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T16:55:29.771Z"}, "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5."}], "source": {"advisory": "GHSA-3v9h-3hrm-29cx", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54730", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T17:18:38.520288Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T17:21:01.400Z"}}]}}

{"affected": [{"affectedData": [{"product": "authentik", "vendor": "goauthentik", "versions": [{"status": "affected", "version": "< 2026.2.6"}, {"status": "affected", "version": ">= 2026.5.0, < 2026.5.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5."}, {"lang": "es", "value": "authentik es un proveedor de identidad de c\u00f3digo abierto. Antes de 2026.2.6 y 2026.5.5, las etapas de confianza de dispositivo de Google Chrome empresariales avanzan el flujo sin confirmar que la atestaci\u00f3n de dispositivo fuera de banda realmente se ejecut\u00f3. Las implementaciones empresariales afectadas colocan una etapa de punto final de Google Chrome con el modo establecido en REQUIRED o la etapa de conector de confianza de dispositivo de Google Chrome obsoleta en un flujo de autenticaci\u00f3n. La atestaci\u00f3n del dispositivo ocurre en un iframe de verificaci\u00f3n que llama a la API de Google Verified Access y registra el dispositivo verificado al tener \u00e9xito, pero las etapas vulnerables tratan el flujo como aprobado tan pronto como se env\u00eda la etapa. Un atacante que puede alcanzar dicha etapa, incluyendo despu\u00e9s de la autenticaci\u00f3n primaria de nombre de usuario y contrase\u00f1a, puede omitir el iframe de verificaci\u00f3n y autenticarse desde un dispositivo que nunca fue verificado. Donde la confianza del dispositivo es el \u00fanico factor adicional, esa protecci\u00f3n es completamente eludida, mientras que otros factores configurados permanecen en vigor. Este problema est\u00e1 solucionado en las versiones 2026.2.6 y 2026.5.5."}], "id": "CVE-2026-54730", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54730", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T17:18:38.520288Z", "version": "2.0.3"}}]}, "published": "2026-08-18T17:16:59.350", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/commit/27866a94f29d0d7f784b3c462a697a968d3f6b9c"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/commit/85adb0bbbd7ad4f2807ec21cf25bb42aee81afbc"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/pull/24053"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/pull/24058"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-807"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2026.5.0,2026.5.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "authentik", "source": "cna", "vendor": "goauthentik"}, "product": "authentik", "vendor": "goauthentik"}], "created": "2026-08-18T19:00:12.169196+00:00", "updated": "2026-08-18T19:45:03.049546+00:00", "vendors": ["goauthentik", "goauthentik$PRODUCT$authentik"]}