goauthentik / goauthentik/authentik

Recovery flow Email stage renders and creates verification token, but send_mail task is never enqueued

Open
#26,073 2 comments 0 reactions 0 assignees View on GitHub
bug triage
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Describe the bug

Version: 2026.8.2 (Docker)

Description:
Using the bundled example/flows-recovery-email-verification.yaml blueprint (both as originally imported and after fully deleting/recreating the blueprint instance and flow from scratch), the recovery flow's Email stage correctly:

Renders component: "ak-stage-email" after successful identification (confirmed via HAR capture, no email-sent cached response)
Creates a verification token visible under the user's Tokens page

However, authentik.stages.email.tasks.send_mail is never enqueued — confirmed via docker logs authentik_server | grep send_mail and docker logs authentik_worker | grep send_mail at the exact HAR-captured timestamp, both returning no results.

Global email settings are confirmed fully functional: ak test_email successfully sends via the same SMTP configuration (Resend), confirming this is not an SMTP/DNS/credentials issue.

Email stage config: "Use global connection settings" checked, Template = "Password Reset", Subject = "authentik". No policies bound to the stage.

### How to reproduce

1. Import example/flows-recovery-email-verification.yaml as a Blueprint instance
2. Set as brand's Recovery flow
3. Trigger recovery, submit valid username/email
4. Flow correctly advances to Email stage, token is created, but no email is sent and no send_mail task appears in server or worker logs

### Expected behavior

Triggered email send with password recovery url

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.8.2

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Research direction

Start with the recovery flow Email stage and authentik.stages.email.tasks.send_mail, reproducing the bundled example/flows-recovery-email-verification.yaml flow in Docker. Compare the successful token creation with task enqueueing and inspect server and worker logs; done means recovery triggers send_mail and delivers the password recovery email.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.