Security Policy
Authentik takes security very seriously. We follow the rules of responsible disclosure, and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
Supported Versions
(.x being the latest patch release for each version)
| Version | Supported |
|---|---|
| 2022.10.x | ✅ |
| 2022.11.x | ✅ |
Reporting a Vulnerability
To report a vulnerability, send an email to security@goauthentik.io. Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the bug.
Criticality levels
High
- Authorization bypass
- Circumvention of policies
Moderate
- Denial-of-Service attacks
Low
- Unvalidated redirects
- Issues requiring uncommon setups
Disclosure process
- Issue is reported via Email as listed above.
- The authentik Security team will try to reproduce the issue and ask for more information if required.
- A criticality level is assigned.
- A fix is created, and if possible tested by the issue reporter.
- The fix is backported to other supported versions, and if possible a workaround for other versions is created.
- An announcement is sent out with a fixed release date and criticality level of the issue. The announcement will be sent at least 24 hours before the release of the fix
- The fixed version is released for the supported versions.
Getting security notifications
To get security notifications, join the discord server. In the future there will be a mailing list too.