Skip to content
THREATWIRE

authentik

Self-hosted identity provider

Identity provider supporting OIDC, OAuth 2.0, SAML, LDAP, RADIUS and a proxy provider, with flow-based customisation of every login step.

Open sourceMIT
Alternative toOktaAuth0
Visit website View repository Docs
Homepage of authentik
Official website (goauthentik.io), captured by ThreatWire.

What authentik does

authentik provides single sign-on for self-hosted and enterprise applications. Beyond OIDC and SAML it can expose an LDAP interface, a RADIUS server and an authenticating reverse proxy for apps that have no SSO support.

Authentication, enrolment and recovery are built from configurable flows and stages, with policies written in Python expressions. Authentik Security Inc. sells an enterprise edition on top of the MIT-licensed core.

Key features

  • OIDC, OAuth 2.0, SAML, LDAP and RADIUS providers
  • Proxy provider for apps without SSO
  • Flow and stage based customisation
  • MFA, WebAuthn and passwordless
  • Docker Compose and Helm deployment

Licence

MIT · MIT License (core) · Open source

Open core: code outside authentik/enterprise is MIT, website content is CC BY-SA 4.0 and the enterprise directory has its own licence (see LICENSE). GitHub does not detect the licence.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.

Security of authentik itself

47 published advisories for authentik in GitHub repository advisories and OSV.dev; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.

  • GHSA-cxwx-9x59-28qmCVE-2026-94613high2026-09-09

    Denial of Service via Malformed SAML Messages

  • GHSA-qgqp-xh8r-v73rCVE-2026-94606high2026-09-09

    MFA bypass via recipient override in the email authenticator

  • GHSA-h6c5-mpvq-j4jcCVE-2026-94609high2026-09-09

    Privilege escalation via delegated group and user management

  • GHSA-m9h4-7j9c-55x9CVE-2026-94611high2026-09-09

    Certain stored credentials readable with view permission alone

  • GHSA-cqj8-fxxf-9pg7CVE-2026-94612high2026-09-09

    Authentication bypass in SAML Sources via assertion confusion and replay

  • GHSA-35v6-hv2g-6992CVE-2026-57580high2026-07-15

    Account Takeover via SAML NameID Comment Truncation

  • GHSA-h8ff-c3h7-2gf8CVE-2026-55106medium2026-07-15

    LDAP Source debug endpoint accessible without authorization

  • GHSA-rv9x-92g6-9cpfCVE-2026-61574high2026-07-15

    RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries

  • GHSA-3v9h-3hrm-29cxCVE-2026-54730high2026-07-15

    Google Chrome device trust stages can be bypassed

  • GHSA-hmrg-vpp4-gj88medium2026-07-15

    Broken access control in Shared Signals Framework stream management

  • GHSA-xp7f-xjjx-gwm8CVE-2026-49448critical2026-05-28

    SourceStage bypass via empty POST

  • GHSA-wr38-7xg8-fqxrCVE-2026-49443high2026-05-28

    `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Identity, access and secrets management#sso#oidc#saml#ldap#proxy#saml-idp#saml-sp#oauth2#oauth2-server#oauth2-client

Related tools

  • Keycloak

    Identity and access management for apps and services

    Identity provider with single sign-on, OpenID Connect, OAuth 2.0 and SAML, user federation, MFA and fine-grained authorisation. A CNCF project.

    Stars
    37k
    Forks
    9.1k
    Last commit
    today
    Apache-2.0Open sourceIdentity, access and secrets management
    Alternative toOktaAuth0

  • HashiCorp Vault

    Secrets management and encryption as a service

    Secrets manager that stores and issues credentials, certificates and keys, with dynamic secrets, encryption as a service and detailed audit logs.

    Stars
    36k
    Forks
    4.8k
    Last commit
    today
    BUSL-1.1Source-availableIdentity, access and secrets management

  • Infisical

    Secrets, certificates and access management platform

    Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.

    Stars
    30k
    Forks
    2.4k
    Last commit
    today
    MITOpen sourceIdentity, access and secrets management
    Alternative toHashiCorp Vault

  • OpenBao

    Community fork of Vault under an open-source licence

    Linux Foundation project that forked HashiCorp Vault's last MPL-licensed code to keep an open-source secrets manager with a compatible API.

    Stars
    8.6k
    Forks
    636
    Last commit
    today
    MPL-2.0Open sourceIdentity, access and secrets management
    Alternative toHashiCorp Vault

  • KeePassXC

    Offline, cross-platform password manager

    Community port of KeePass for Windows, macOS and Linux that stores passwords in an encrypted KDBX database file you control.

    Stars
    29k
    Forks
    2k
    Last commit
    1 day ago
    GPL-2.0-only OR GPL-3.0-onlyOpen sourcePasswords and credential auditing
    Alternative to1Password
Share on X@threatwire_https://www.threatwire.tech/tools/authentik