goauthentik / goauthentik/authentik

Gravatar switched to sha-256 and authentik is still usig md5

Open
#19,216 0 comments 1 reaction 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Describe the bug

When using the gravatar option for avatars settings under System>Settings, Authentik hash the user email with md5 and then try to fetch https://gravatar.com/avatar/{email_has}

And due to md5 being vulnerable to collision attack, gravatar switched to sha-256 hashing

However, Authentik is still trying to use the md5 hash of the email address to fetch the avatac image

### How to reproduce

1. Hash your email in md5
2. Go to https://gravatar.com/site/check and type your email
3. Watch gravatar giving you a different hash

### Expected behavior

Athentik should fetch the gravatar url with the sha-256 of the user email

### Screenshots

Image

Image

### Additional context

_No response_

### Deployment Method

Docker

### Version

2025.10.3

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.