goauthentik / goauthentik/authentik
Gravatar switched to sha-256 and authentik is still usig md5
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Describe the bug
When using the gravatar option for avatars settings under System>Settings, Authentik hash the user email with md5 and then try to fetch https://gravatar.com/avatar/{email_has}
And due to md5 being vulnerable to collision attack, gravatar switched to sha-256 hashing
However, Authentik is still trying to use the md5 hash of the email address to fetch the avatac image
### How to reproduce
1. Hash your email in md5
2. Go to https://gravatar.com/site/check and type your email
3. Watch gravatar giving you a different hash
### Expected behavior
Athentik should fetch the gravatar url with the sha-256 of the user email
### Screenshots
### Additional context
_No response_
### Deployment Method
Docker
### Version
2025.10.3
### Relevant log output
```shell
```
Contributor guide
Assessment
This issue has not been assessed yet.