CVE-2026-54730

{
  "id": "CVE-2026-54730",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T17:16:59.350",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5."
    },
    {
      "lang": "es",
      "value": "authentik es un proveedor de identidad de código abierto. Antes de 2026.2.6 y 2026.5.5, las etapas de confianza de dispositivo de Google Chrome empresariales avanzan el flujo sin confirmar que la atestación de dispositivo fuera de banda realmente se ejecutó. Las implementaciones empresariales afectadas colocan una etapa de punto final de Google Chrome con el modo establecido en REQUIRED o la etapa de conector de confianza de dispositivo de Google Chrome obsoleta en un flujo de autenticación. La atestación del dispositivo ocurre en un iframe de verificación que llama a la API de Google Verified Access y registra el dispositivo verificado al tener éxito, pero las etapas vulnerables tratan el flujo como aprobado tan pronto como se envía la etapa. Un atacante que puede alcanzar dicha etapa, incluyendo después de la autenticación primaria de nombre de usuario y contraseña, puede omitir el iframe de verificación y autenticarse desde un dispositivo que nunca fue verificado. Donde la confianza del dispositivo es el único factor adicional, esa protección es completamente eludida, mientras que otros factores configurados permanecen en vigor. Este problema está solucionado en las versiones 2026.2.6 y 2026.5.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "goauthentik",
          "product": "authentik",
          "versions": [
            {
              "version": "< 2026.2.6",
              "status": "affected"
            },
            {
              "version": ">= 2026.5.0, < 2026.5.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T17:18:38.520288Z",
          "id": "CVE-2026-54730",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-807"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/goauthentik/authentik/commit/27866a94f29d0d7f784b3c462a697a968d3f6b9c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/commit/85adb0bbbd7ad4f2807ec21cf25bb42aee81afbc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/pull/24053",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/pull/24058",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-3v9h-3hrm-29cx",
      "source": "[email protected]"
    }
  ]
}