Skip to content

CVE-2026-49443 / GHSA-5wcc-hf24-rf5h

UserSourceConnection.user and GroupSourceConnection.group are changeable through the API

Summary

An attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account.

Patches

authentik 2026.5.1, 2026.2.4, and 2025.12.6 fix this issue.

Impact

UserSourceConnection.user and GroupSourceConnection.group are changeable through the API. This lets attackers with low privilege (*_usersourceconnection, *_group*sourceconnection) misrepresent users/groups as if they were coming from a specific source, with a specific identifier, then authenticate as the victim through that source and identifier.

Workarounds

Ensure that *_usersourceconnection, *_group*sourceconnection permissions are only given to trusted admins.

For more information

If you have any questions or comments about this advisory: