High severity8.8NVD Advisory· Published Jun 28, 2024· Updated Jun 17, 2026

CVE-2024-37905

Description

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including resetting user passwords and more. This issue has been patched in version(s) 2024.2.4, 2024.4.2 and 2024.6.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

authentik/authentik3 versions
cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*range: <2024.2.4
- (no CPE)range: before 2024.2.4, 2024.4.2, 2024.6.0
- (no CPE)range: < 2024.6.0
osv-coords
pkg:bitnami/authentik
Range: < 2024.6.0

Patches

Vulnerability mechanics

References

github.com/goauthentik/authentik/security/advisories/GHSA-c78c-2r9w-p7x4nvdVendor Advisory
github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4nvdRelease Notes
github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3nvdRelease Notes
github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000