Authentik: Open Source Alternative to Auth0, Clerk and WorkOS

Multiple software vulnerabilities disclosed

Six distinct command injection, file inclusion, and authentication bypass vulnerabilities were disclosed between September 24–26, 2026, affecting Frictionless, Cambium, Lantronix, WordPress Visual Composer, Netis routers, and Netlink routers. Each report describes a separate product flaw with no common thread beyond being security exploits.

🎙️ Sponsored: Authentik is rethinking PAM for AI agents https:// risky.biz/RBNEWSSI143/

CVE-2026-94611 - authentik: Stored credentials are readable with view permission alone

CVE-2026-94611 - authentik: Stored credentials are readable with view permission alone CVE ID : CVE-2026-94611 Published : 24 septembre 2026 17:17 | 21 minutes ago Description : authentik is an open-source identity provider. 2, aut...

Went to a "kite flying" session for Co-op Cloud today and got some help with setting up Authentik, it was really nice!

My # Authentik stack randomly fails to start fully with "Address already in use". Not the way I wanted to start my day, I need to work, not debug this. # homelab

Open-source projects release security and stability updates

Multiple open-source projects released updates between 2026-09-10 and 2026-09-12: Authentik rolled out versions 2026.8.2, 2026.2.7, and 2026.5.7 with security patches and bug fixes, while Nextcloud Server v34.0.4 addressed stability improvements. All updates focus on security hardening and bug resolution for self-hosted deployments.

authentik 2026.8.0 is here with OAuth2 DCR fixes, SAML audience override for sources, configurable failure actions, blueprint improvements, and DB optimizations for requestable apps. # selfhosted # ho

Mealie v3.23.0 overhauls AI recipe imports into one unified page with smaller context windows for better results. Also adds native OIDC support for Pocket ID and authentik. # selfhosted # homelab http

Back from a weekend trip. State of my # homelab : * # Authentik failed again and refuses to start (gunicorn coredumps), therefore I can't login into anything * one of my monitor's PSU decided to die *

SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents

21929v1 Announce Type: new Abstract: Agent skills extend coding agents with task-specific instructions, scripts, and resources, but they also create a trusted instruction channel that can be abused beyond conventional security attacks. This paper studies token amplification through skill injection: an economic resource-abuse threat in which a malicious skill causes an agent to consume substantially more tokens than needed for normal task execution.

The underlying issue was that some process dumped core. Probably bad system update? I ran a new VM image build and it works for now. Broken colors in Rust stack traces don't help debugging and this th