High severity8.6NVD Advisory· Published Jun 28, 2024· Updated Jun 17, 2026

CVE-2024-38371

Description

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

authentik/authentik3 versions
cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*range: <2024.2.4
- (no CPE)range: before 2024.6.0, 2024.2.4, 2024.4.3
- (no CPE)range: < 2024.6.0
osv-coords
pkg:bitnami/authentik
Range: < 2024.6.0

Patches

Vulnerability mechanics

References

github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45nvdMitigationVendor Advisory
github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4nvdRelease Notes
github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3nvdRelease Notes
github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000