authentik

Vulnerabilities (36)

• CVE-2024-52287HigNov 21, 2024
  affected < 2024.8.5fixed 2024.8.5

  authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.

• CVE-2024-47077MedSep 27, 2024
  affected < 2024.6.5fixed 2024.6.5

  authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were le

• CVE-2024-47070CriSep 27, 2024
  affected < 2024.6.5fixed 2024.6.5

  authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any accoun

• CVE-2024-42490HigAug 22, 2024
  affected < 2024.4.4fixed 2024.4.4

  authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//view_certificate/, /api/v3/crypto/certificatekeypairs/

• CVE-2024-38371HigJun 28, 2024
  affected < 2024.6.0fixed 2024.6.0

  authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This i

• CVE-2024-37905HigJun 28, 2024
  affected < 2024.6.0fixed 2024.6.0

  authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik appli

• CVE-2024-23647MedJan 30, 2024
  affected < 2023.8.7fixed 2023.8.7

  Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token

• CVE-2024-21637HigJan 11, 2024
  affected >= 2023.8.0, < 2023.8.6fixed 2023.8.6

  Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escal

• CVE-2023-48228HigNov 21, 2023
  affected < 2023.8.5fixed 2023.8.5

  authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to

• CVE-2023-46249CriOct 31, 2023
  affected < 2023.8.4fixed 2023.8.4

  authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint t

• CVE-2023-39522MedAug 29, 2023
  affected < 2023.5.6fixed 2023.5.6

  goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system

• CVE-2023-36456HigJul 6, 2023
  affected < 2023.4.3fixed 2023.4.3

  authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without

• CVE-2023-26481CriMar 4, 2023
  affected < 2022.12.3fixed 2022.12.3

  authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, whi

• CVE-2022-46172MedDec 28, 2022
  affected >= 2022.10.0, < 2022.10.4fixed 2022.10.4

  authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where

• CVE-2022-23555CriDec 28, 2022
  affected < 2022.10.4fixed 2022.10.4

  authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Authentication. Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow than

• CVE-2022-46145HigDec 2, 2022
  affected < 2022.10.2fixed 2022.10.2

  authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows f