goauthentik / goauthentik/authentik

Enrollment with invitation overwrite the akadmin account

Open
#16,800 3 comments 1 reaction 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe the bug**
If an administrator connected as akadmin follows an invitation link in the same browser window, the akadmin account will be overwritten by the username seted within the invitation.

**To Reproduce**
Steps to reproduce the behavior:

1. Connect to Authentik as akadmin
2. Create an invitation
3. Open the invitation in the same browser window that the akadmin connection
4. Follow the enrollment process

**Expected behavior**
The akadmin user should be protected to not be broken accidentally.
For example if we open the invitation link in the bad browser:
- solution 1:
- to disconnect the akadmin user
- to create the new user
- solution 2:
- to display an error message to inform that you are connected as akadmin and then you are unable to continue the invitation process

**Version and Deployment (please complete the following information):**

- authentik version: 2025.8.1
- Deployment: docker-compose

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.