Bitnami package
authentik
pkg:bitnami/authentik
Vulnerabilities (27)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-25922 | — | < 2025.8.6 | 2025.8.6 | Feb 12, 2026 | authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificat | ||
| CVE-2026-25748 | — | >= 2025.10.0, < 2025.12.4 | 2025.12.4 | Feb 12, 2026 | authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. Whe | ||
| CVE-2026-25227 | — | >= 2021.3.1, < 2025.8.6 | 2025.8.6 | Feb 12, 2026 | authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authe | ||
| CVE-2025-64708 | — | < 0.0.0-20251119135424-6672e6aaa41e | 0.0.0-20251119135424-6672e6aaa41e | Nov 19, 2025 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this c | ||
| CVE-2025-64521 | — | < 0.0.0-20251119140106-9dbdfc3f1be0 | 0.0.0-20251119140106-9dbdfc3f1be0 | Nov 19, 2025 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this accoun | ||
| CVE-2025-53942 | — | < 2025.4.4 | 2025.4.4 | Jul 23, 2025 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked | ||
| CVE-2025-52553 | — | < 2025.4.3 | 2025.4.3 | Jun 27, 2025 | authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the | ||
| CVE-2025-29928 | — | < 2024.12.4 | 2024.12.4 | Mar 28, 2025 | authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the | ||
| CVE-2024-11623 | — | < 2024.10.4 | 2024.10.4 | Feb 4, 2025 | Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release. | ||
| CVE-2024-52287 | — | < 2024.8.5 | 2024.8.5 | Nov 21, 2024 | authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue. | ||
| CVE-2024-52289 | — | < 2024.8.5 | 2024.8.5 | Nov 21, 2024 | authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirect_uri value received as an allowed redirect URI, | ||
| CVE-2024-52307 | — | < 2024.8.5 | 2024.8.5 | Nov 21, 2024 | authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not | ||
| CVE-2024-47077 | — | < 2024.6.5 | 2024.6.5 | Sep 27, 2024 | authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were le | ||
| CVE-2024-47070 | — | < 2024.6.5 | 2024.6.5 | Sep 27, 2024 | authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any accoun | ||
| CVE-2024-42490 | — | < 2024.4.4 | 2024.4.4 | Aug 22, 2024 | authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//view_certificate/, /api/v3/crypto/certificatekeypairs/ | ||
| CVE-2024-38371 | — | < 2024.6.0 | 2024.6.0 | Jun 28, 2024 | authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This i | ||
| CVE-2024-37905 | — | < 2024.6.0 | 2024.6.0 | Jun 28, 2024 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik appli | ||
| CVE-2024-23647 | — | < 2023.8.7 | 2023.8.7 | Jan 30, 2024 | Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token | ||
| CVE-2024-21637 | — | >= 2023.8.0, < 2023.8.6 | 2023.8.6 | Jan 11, 2024 | Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escal | ||
| CVE-2023-48228 | — | < 2023.8.5 | 2023.8.5 | Nov 21, 2023 | authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to |
- CVE-2026-25922Feb 12, 2026affected < 2025.8.6fixed 2025.8.6
authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificat
- CVE-2026-25748Feb 12, 2026affected >= 2025.10.0, < 2025.12.4fixed 2025.12.4
authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. Whe
- CVE-2026-25227Feb 12, 2026affected >= 2021.3.1, < 2025.8.6fixed 2025.8.6
authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authe
- CVE-2025-64708Nov 19, 2025affected < 0.0.0-20251119135424-6672e6aaa41efixed 0.0.0-20251119135424-6672e6aaa41e
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this c
- CVE-2025-64521Nov 19, 2025affected < 0.0.0-20251119140106-9dbdfc3f1be0fixed 0.0.0-20251119140106-9dbdfc3f1be0
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this accoun
- CVE-2025-53942Jul 23, 2025affected < 2025.4.4fixed 2025.4.4
authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked
- CVE-2025-52553Jun 27, 2025affected < 2025.4.3fixed 2025.4.3
authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the
- CVE-2025-29928Mar 28, 2025affected < 2024.12.4fixed 2024.12.4
authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the
- CVE-2024-11623Feb 4, 2025affected < 2024.10.4fixed 2024.10.4
Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.
- CVE-2024-52287Nov 21, 2024affected < 2024.8.5fixed 2024.8.5
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.
- CVE-2024-52289Nov 21, 2024affected < 2024.8.5fixed 2024.8.5
authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirect_uri value received as an allowed redirect URI,
- CVE-2024-52307Nov 21, 2024affected < 2024.8.5fixed 2024.8.5
authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not
- CVE-2024-47077Sep 27, 2024affected < 2024.6.5fixed 2024.6.5
authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were le
- CVE-2024-47070Sep 27, 2024affected < 2024.6.5fixed 2024.6.5
authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any accoun
- CVE-2024-42490Aug 22, 2024affected < 2024.4.4fixed 2024.4.4
authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//view_certificate/, /api/v3/crypto/certificatekeypairs/
- CVE-2024-38371Jun 28, 2024affected < 2024.6.0fixed 2024.6.0
authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This i
- CVE-2024-37905Jun 28, 2024affected < 2024.6.0fixed 2024.6.0
authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik appli
- CVE-2024-23647Jan 30, 2024affected < 2023.8.7fixed 2023.8.7
Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token
- CVE-2024-21637Jan 11, 2024affected >= 2023.8.0, < 2023.8.6fixed 2023.8.6
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escal
- CVE-2023-48228Nov 21, 2023affected < 2023.8.5fixed 2023.8.5
authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to
Page 1 of 2