One Login for Everything: Caddy Forward Auth in Front of Every Self-Hosted App
Put Authentik's forward-auth check behind a single Caddy reverse proxy and every app on your lab gets login + MFA — even the ones with no SSO support at all.
sso
2 dispatches · latest 02 SEP 2026 · all keywords →
Your authentik 'Helpdesk' Admin Might Be Superuser: CVE-2026-40172 (Not KEV, But Patch It)
A delegated authentik user manager can grant themselves admin-equivalent by assigning arbitrary groups, including is_superuser=True, via the user API. No KEV, no confirmed in-the-wild — but if you run delegated admins, check your SSO.
Moderate severity, 2 of 4. Known flaw, no confirmed in-the-wild exploitation. Fix it when you next touch the box.CVSS 8.1CVE-2026-40172
authentikself-hostedsso