A critical authentication vulnerability in goauthentik allows unauthenticated attackers to hijack user accounts by manipulating email factor enrollment, potentially granting full access to protected single sign-on applications.

The application incorrectly trusts user-supplied input for the email recipient address during the enrollment flow. An attacker who knows a target user's password can provide a malicious email address to capture the one-time authentication code and complete the enrollment process.

Successful exploitation allows an attacker to gain a session as the target user, effectively bypassing multi-factor authentication for the email factor. Given the CVSS score of 8.9, this represents a high-severity risk that could lead to unauthorized access to sensitive corporate applications and data protected by the identity provider.

Immediate Action: Update your goauthentik deployment to version 2026.2.7, 2026.5.7, or 2026.8.2 immediately to enforce secure email address validation during enrollment.

Proactive Monitoring: Review authentication and enrollment logs for unusual patterns, such as multiple email enrollment attempts for the same account or discrepancies between registered user emails and enrollment email addresses.

Compensating Controls: While no direct WAF rule can stop this logic flaw, organizations can temporarily disable email-based multi-factor authentication if they suspect the environment is being actively targeted.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to identity integrity, particularly for organizations relying on email-based MFA within the goauthentik platform. Security teams must prioritize patching to the versions listed above to close this logic gap. Failure to remediate ensures that any user account with a compromised password is at immediate risk of full account takeover and persistent session access.