authentik

Vulnerabilities (36)

• CVE-2024-52307Nov 21, 2024
  affected < 2024.8.5fixed 2024.8.5

  authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not

• CVE-2024-47077Sep 27, 2024
  affected < 2024.6.5fixed 2024.6.5

  authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were le

• CVE-2024-47070Sep 27, 2024
  affected < 2024.6.5fixed 2024.6.5

  authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any accoun

• CVE-2024-42490Aug 22, 2024
  affected < 2024.4.4fixed 2024.4.4

  authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//view_certificate/, /api/v3/crypto/certificatekeypairs/

• CVE-2024-38371Jun 28, 2024
  affected < 2024.6.0fixed 2024.6.0

  authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This i

• CVE-2024-37905Jun 28, 2024
  affected < 2024.6.0fixed 2024.6.0

  authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik appli

• CVE-2024-23647Jan 30, 2024
  affected < 2023.8.7fixed 2023.8.7

  Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token

• CVE-2024-21637Jan 11, 2024
  affected >= 2023.8.0, < 2023.8.6fixed 2023.8.6

  Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escal

• CVE-2023-48228Nov 21, 2023
  affected < 2023.8.5fixed 2023.8.5

  authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to

• CVE-2023-46249Oct 31, 2023
  affected < 2023.8.4fixed 2023.8.4

  authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint t

• CVE-2023-39522Aug 29, 2023
  affected < 2023.5.6fixed 2023.5.6

  goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system

• CVE-2023-36456Jul 6, 2023
  affected < 2023.4.3fixed 2023.4.3

  authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without

• CVE-2023-26481Mar 4, 2023
  affected < 2022.12.3fixed 2022.12.3

  authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, whi

• CVE-2022-46172Dec 28, 2022
  affected >= 2022.10.0, < 2022.10.4fixed 2022.10.4

  authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where

• CVE-2022-23555Dec 28, 2022
  affected < 2022.10.4fixed 2022.10.4

  authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Authentication. Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow than

• CVE-2022-46145Dec 2, 2022
  affected < 2022.10.2fixed 2022.10.2

  authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows f