Skip to content

Enrollment with invitation overwrite the akadmin account #16800

@KortexSys

Description

@KortexSys

Describe the bug
If an administrator connected as akadmin follows an invitation link in the same browser window, the akadmin account will be overwritten by the username seted within the invitation.

To Reproduce
Steps to reproduce the behavior:

  1. Connect to Authentik as akadmin
  2. Create an invitation
  3. Open the invitation in the same browser window that the akadmin connection
  4. Follow the enrollment process

Expected behavior
The akadmin user should be protected to not be broken accidentally.
For example if we open the invitation link in the bad browser:

  • solution 1:
    • to disconnect the akadmin user
    • to create the new user
  • solution 2:
    • to display an error message to inform that you are connected as akadmin and then you are unable to continue the invitation process

Version and Deployment (please complete the following information):

  • authentik version: 2025.8.1
  • Deployment: docker-compose

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingbug/confirmedConfirmed bugs

    Type

    Projects

    Status

    Todo

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions