CVE-2026-49448

An attacker can bypass the Source stage by sending an empty POST request to the flow executor URL. This bypass occurs when the flow executor receives a POST request while the SourceStage is current. Instead of validating a restore token, the system falls through to a default Django view dispatch, which then incorrectly validates an empty challenge response and advances the flow to the next stage, effectively skipping authentication at the source [ref_id=1].

The vulnerability lies within the SourceStage's handling of POST requests when no restore token is present. Specifically, the `SourceStageView.dispatch()` method falls through to `super().dispatch()`, which eventually leads to `ChallengeResponse(data={}).is_valid()` returning true, allowing the flow to advance incorrectly [ref_id=1].

The patch ensures that an empty POST request to the Source stage does not result in advancing the flow. The advisory states that the issue is resolved in versions 2025.12.6, 2026.2.4, and 2026.5.1, implying that the logic handling POST requests within the Source stage has been corrected to properly validate incoming data and prevent unauthorized progression [ref_id=1].

def test_source_post_bypass(self): """CWE-863: empty POST to SourceStage must NOT advance the flow. With the vulnerability present this test FAILS at the final assertion because the client is logged in as `user` without ever touching the IdP.""" user = create_test_user() flow = create_test_flow(FlowDesignation.AUTHENTICATION) FlowStageBinding.objects.create( target=flow, stage=IdentificationStage.objects.create( name=generate_id(), user_fields=[UserFields.USERNAME], ), order=0, ) FlowStageBinding.objects.create( target=flow, stage=SourceStage.objects.create(name=generate_id(), source=self.source), order=5, ) FlowStageBinding.objects.create( target=flow, stage=UserLoginStage.objects.create(name=generate_id()), order=10, ) exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})

# 1) Start flow → identification challenge response = self.client.get(exec_url) self.assertStageResponse(response, flow, component="ak-stage-identification")

# 2) Submit username only (Identification does not verify credentials) response = self.client.post(exec_url, data={"uid_field": user.username}, follow=True) self.assertEqual(response.status_code, 200) # Now positioned on SourceStage; legitimate path would redirect to SAML IdP.

# 3) BYPASS: POST empty body instead of authenticating at the IdP response = self.client.post(exec_url, data={}, follow=True) self.assertEqual(response.status_code, 200)

# Vulnerable behaviour: SourceStage returned stage_ok(), UserLoginStage ran, # and we are now authenticated as `user` with zero credentials presented. # A secure implementation would leave us unauthenticated here. self.assertFalse( self.client.session.get("_auth_user_id"), "SourceStage was bypassed: session authenticated without IdP interaction", ) [ref_id=1]