authentik: 10,425 titles, 16 fingerprints, and an identity provider that hides behind its own login page

Identity providers are supposed to be boring to look at. The login page of an authentik deployment is a form with a username field, and behind it sits the component that decides who can use every application integrated with it. Measuring that component from the outside is harder than it looks, and the numbers show why.

Three queries, three answers

On 23 October 2026, ZoomEye returned 10,425 matches for title="authentik", 16 matches for app="authentik", and 1,399 matches for title="authentik" && port="9443".
The port in the third query is meaningful. authentik's reference Docker Compose deployment exposes HTTPS on 9443 and HTTP on 9000, which means the 1,399 hosts on 9443 are the subset that kept the default TLS port mapping. The remaining title matches are behind reverse proxies, on custom ports, or on a hostname where the port is invisible.
The 16 application fingerprints are the most interesting number of the three. Sixteen is small enough to review by hand, and it suggests the fingerprint is detecting a narrow response characteristic rather than the product in general.

What a title match includes

authentik's login page uses the product name, and so does its documentation. A title query therefore catches the documentation site, blog posts that screenshot the interface, Helm chart READMEs served over HTTP, and the product's own project pages. The 10,425 figure is a string population, not an installation count.
This is not a flaw in the search engine. It is the correct behaviour of a title field, and it is the reason an analyst should never report a title count as adoption.

The consequence of being an identity provider

If authentik is the component that decides who can reach an application, then the exposure question is not how many deployments exist. It is how many deployments are reachable at a level that bypasses the policy the product is supposed to enforce.
Those levels are worth naming. The user-facing authentication flow is reachable by design. The administrative interface is a different surface with different privilege. The outpost and provider APIs that integrate authentik with applications are a third. An inventory that counts "authentik hosts" collapses three different risks into one number.
The default port mapping is a weak but usable proxy for maturity. A deployment that kept 9443 is a deployment installed from the documented Compose file and probably not customised much. That is not inherently safer, and it is not inherently riskier. It is a deployment whose defaults are visible, and defaults are where an attacker looks first.

Reading the counts honestly

State the facts as they were collected: 10,425 title matches, 16 application fingerprint matches, and 1,399 title matches restricted to port 9443, sub-type all, collected on 23 October 2026. None of these numbers describes a version, a configuration, or a vulnerability. authentik releases carry security fixes regularly, and the counts say nothing about which release a host is running.
What the numbers do support is a thesis about visibility. An identity provider presents one page to the world, and that page is the same whether the deployment is a hardened production cluster or a test instance on a laptop with a public IP. External measurement can tell you the page exists. Everything that matters is behind it.

Practical steps for the operator

Inventory every authentik deployment you own, including the ones in test namespaces, because an identity provider in a test namespace usually holds real directory credentials. Record the flow configuration, the enabled providers, and which outposts reach into which networks.
Restrict the administrative interface to a management network and require a second factor for it that is distinct from the factor used for user login. The administrative account on an identity provider is the highest-value account in the estate, and it is often protected less carefully than a cloud root account.
Then examine what the product can reach. A directory integration that can read all users and groups is a data source for anyone who compromises the provider. An outpost that sits inside a production subnet is a foothold if the provider is compromised. Those are design decisions that no external scan can evaluate and no patch can undo.

The measurement point

Products whose public face is a single login page are the hardest to count and the most consequential to miscount. The gap between 10,425 and 16 is not a curiosity. It is a reminder that the string "authentik" appears in places that have nothing to do with an authentik server, and that a defensible exposure number for this category has to come from a fingerprint, a port constraint, or both.

References

• authentik documentation, Docker Compose installation, https://docs.goauthentik.io/install-config/install/docker-compose
• authentik project repository, https://github.com/goauthentik/authentik
• ZoomEye AI query results collected 23 October 2026 for title="authentik", app="authentik", and title="authentik" && port="9443", sub-type all