goauthentik / goauthentik/authentik

Authentik sends an email to root@example.com

Open
#23,043 3 comments 0 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Describe the bug

I got a bounce notification from my SMTP provider saying my email to root@example.com could not be delivered (obviously, that's not a real email address).

Apparently, Authentik tried to send such an email. Why? According to the audit logs:

Image

But I never configured such a user account nor set such an email address. It seems like a bug that Authentik would ever try to send an email to an address that I never configured, without asking.

I can see where Authentik hardcodes root@example.com:

https://github.com/goauthentik/authentik/blob/ec4847182d5cd2a65d7be01f4fde8b22fb90b061/blueprints/system/bootstrap.yaml#L12

But not why it's actually using the address, nor how to fix it.

### How to reproduce

This happened without my intervention, and it's an existing installation that has been upgraded from many previous versions, so I don't know how to reproduce it from scratch. I guess one just sets up Authentik with the default settings, enables the SMTP environment variables outlined in the documentation, and doesn't turn off update checking.

### Expected behavior

An email should only be sent to the email address of my actual administrator account that I set up during initial configuration.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.5.2

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Research direction

Start with blueprints/system/bootstrap.yaml at line 12, then trace how that default account or address reaches the audit-log email path. Confirm why an email is sent to root@example.com and define the fix so notifications target only the administrator address configured during initial setup; add or update a regression test if the relevant test location is found.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.