authentik is an open-source identity provider

#!/usr/bin/env python3
# check_authentik_cve_2026_49448.py
# Detect likely exposure to CVE-2026-49448 by version.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

import re
import sys
import ssl
import urllib.request
from urllib.parse import urlparse

TIMEOUT = 10
UA = "noisgate-authentik-check/1.0"


def parse_version(v):
    m = re.fullmatch(r"(\d{4})\.(\d+)\.(\d+)", v.strip())
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def classify(version_str):
    v = parse_version(version_str)
    if not v:
        return ("UNKNOWN", f"Unrecognized version format: {version_str}")

    # Vendor advisory: affected <=2025.12.5, <=2026.2.3, <=2026.5.0
    # Patched: 2025.12.6, 2026.2.4, 2026.5.1 (release skipped; release notes show GHSA in 2026.5.2)
    # Operationally, treat 2026.5.2+ as patched on the 2026.5 line.

    if v[0] == 2025 and v[1] == 12:
        if cmp_ver(v, (2025, 12, 5)) <= 0:
            return ("VULNERABLE", f"Version {version_str} is in affected range <=2025.12.5")
        return ("PATCHED", f"Version {version_str} is newer than 2025.12.5")

    if v[0] == 2026 and v[1] == 2:
        if cmp_ver(v, (2026, 2, 3)) <= 0:
            return ("VULNERABLE", f"Version {version_str} is in affected range <=2026.2.3")
        return ("PATCHED", f"Version {version_str} is newer than 2026.2.3")

    if v[0] == 2026 and v[1] == 5:
        if cmp_ver(v, (2026, 5, 0)) <= 0:
            return ("VULNERABLE", f"Version {version_str} is in affected range <=2026.5.0")
        if cmp_ver(v, (2026, 5, 2)) >= 0:
            return ("PATCHED", f"Version {version_str} is at or beyond the release-notes fix point 2026.5.2")
        if cmp_ver(v, (2026, 5, 1)) == 0:
            return ("PATCHED", f"Version {version_str} matches advisory patched version; note 2026.5.1 was skipped in release notes")

    return ("UNKNOWN", f"Version {version_str} is outside the explicitly documented affected trains")


def fetch(url):
    ctx = ssl.create_default_context()
    req = urllib.request.Request(url, headers={"User-Agent": UA})
    with urllib.request.urlopen(req, timeout=TIMEOUT, context=ctx) as resp:
        return resp.read().decode("utf-8", errors="ignore")


def extract_version_from_html(html):
    patterns = [
        r"version=(\d{4}\.\d+\.\d+)",
        r"authentik[:\s]+(\d{4}\.\d+\.\d+)",
        r"content=\"(\d{4}\.\d+\.\d+)\"[^>]*name=\"version\"",
        r"name=\"version\"[^>]*content=\"(\d{4}\.\d+\.\d+)\"",
    ]
    for pat in patterns:
        m = re.search(pat, html, re.IGNORECASE)
        if m:
            return m.group(1)
    return None


def normalize_url(target):
    if not re.match(r"^https?://", target):
        target = "https://" + target
    p = urlparse(target)
    base = f"{p.scheme}://{p.netloc}"
    return [base + "/if/flow/default-authentication-flow/", base + "/", target]


def main():
    args = sys.argv[1:]
    if not args or args[0] in ("-h", "--help"):
        print("Usage: python3 check_authentik_cve_2026_49448.py <url> | --version <YYYY.M.P>")
        sys.exit(2)

    if args[0] == "--version":
        if len(args) != 2:
            print("UNKNOWN - missing version string")
            sys.exit(2)
        status, reason = classify(args[1])
        print(f"{status} - {reason}")
        sys.exit(0 if status == "PATCHED" else 1 if status == "VULNERABLE" else 2)

    target = args[0]
    errors = []
    for url in normalize_url(target):
        try:
            html = fetch(url)
            version = extract_version_from_html(html)
            if version:
                status, reason = classify(version)
                print(f"{status} - detected authentik version {version} from {url}; {reason}")
                sys.exit(0 if status == "PATCHED" else 1 if status == "VULNERABLE" else 2)
            errors.append(f"No version string found at {url}")
        except Exception as e:
            errors.append(f"{url}: {e}")

    print("UNKNOWN - could not determine authentik version. " + " | ".join(errors))
    sys.exit(2)


if __name__ == "__main__":
    main()