goauthentik / goauthentik/authentik
Enrollment with invitation overwrite the akadmin account
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Describe the bug**
If an administrator connected as akadmin follows an invitation link in the same browser window, the akadmin account will be overwritten by the username seted within the invitation.
**To Reproduce**
Steps to reproduce the behavior:
1. Connect to Authentik as akadmin
2. Create an invitation
3. Open the invitation in the same browser window that the akadmin connection
4. Follow the enrollment process
**Expected behavior**
The akadmin user should be protected to not be broken accidentally.
For example if we open the invitation link in the bad browser:
- solution 1:
- to disconnect the akadmin user
- to create the new user
- solution 2:
- to display an error message to inform that you are connected as akadmin and then you are unable to continue the invitation process
**Version and Deployment (please complete the following information):**
- authentik version: 2025.8.1
- Deployment: docker-compose
Contributor guide
Assessment
This issue has not been assessed yet.