Advisories · Technology
authentik.
Every CVE that names authentik among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.9 High
authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage
- authentik
- Authentication bypass
- CWE-807
- CVSS 8.8 High
authentik: Privilege Escalation to Superuser via Group Hierarchy
- authentik
- Privilege escalation
- Broken access control
- CVSS 8.1 High
authentik: Stored credentials are readable with view permission alone
- authentik
- Information disclosure
- Hard-coded credentials
- CVSS 7.4 High
authentik: Authentication bypass via assertion confusion in SAML sources
- authentik
- Authentication bypass
- CWE-345
- CVSS 7.5 High
authentik: Denial of Service via Document Type Declarations in SAML Messages
- authentik
- Denial of service
- CVSS 9.4 CriticalCritical · CVSS 9+
authentik: Account Takeover via SAML NameID Comment Truncation
- authentik
- CWE-436
- CVSS 5.3 Medium
authentik: Unauthenticated LDAP directory data disclosure
- authentik
- Broken access control
- CVSS 8.8 High
authentik RAC: access any endpoint via an unrelated application
- authentik
- Broken access control
- CVSS 8.6 High
authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView
- authentik
- Broken access control
- CWE-807
- CVSS 8.8 High
Authentik Security authentik - Privilege Escalation
- authentik
- Privilege escalation
- CVSS 8.8 High
Authentik Security authentik - Privilege Escalation
- authentik
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
authentik: SourceStage bypass via empty POST
- authentik
- Authentication bypass
- CVSS 8.8 High
authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
- authentik
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
- authentik
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
- authentik
- Open redirect
- CVSS 6.9 Medium
authentik: SAML source does not validate Conditions, timing, or audience on assertions
- authentik
- CWE-345
- CVSS 8.1 High
authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
- authentik
- Privilege escalation
- CVSS 7.1 High
authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
- authentik
- Information disclosure
- Broken access control
- CVSS 8.7 High
authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
- authentik
- Other injection
- Authentication bypass
- CVSS 8.8 High
authentik has a Signature Verification Bypass via SAML Assertion Wrapping
- authentik
- Authentication bypass
- Weak cryptography or TLS
- CVSS 8.6 High
authentik has a forward authentication bypass with broken cookie
- authentik
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint
- authentik
- Code injection
- CVSS 5.5 Medium
authentik has Insufficient Session verification for Remote Access Control endpoint access
- authentik
- Authentication bypass
- CVSS 8.0 High
authentik's deletion of sessions did not revoke sessions when using database session storage
- authentik
- Authentication bypass
- CVSS 4.8 Medium
Stored XSS in authentik
- authentik
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
authentik performs insufficient validation of OAuth scopes
- authentik
- Broken access control
- CVSS 7.9 High
authentik has an insecure default configuration for OAuth2 Redirect URIs
- authentik
- CWE-185
- CVSS 6.3 Medium
authentik allows a timing attack due to missing constant time comparison for metrics view
- authentik
- CWE-208
- CVSS 6.5 Medium
authentik cross-provider token validation problems
- authentik
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header
- authentik
- Authentication bypass
- CVSS 8.6 High
Insufficient access control for OAuth2 Device Code flow in authentik
- authentik
- Broken access control
- CVSS 8.8 High
Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
- authentik
- Broken access control
- CVSS 7.7 High
XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
- authentik
- Cross-site scripting (XSS)
- CVSS 7.5 High
OAuth2: PKCE can be fully circumvented
- authentik
- Authentication bypass
- CVSS 9.7 CriticalCritical · CVSS 9+
authentik potential installation takeover when default admin user is deleted
- authentik
- Authentication bypass
- CVSS 8.3 High
Authentik lacks Proxy IP headers validation
- authentik
- CWE-436
- CVSS 9.1 CriticalCritical · CVSS 9+
Insufficient user check in FlowTokens by Email stage
- authentik
- CWE-345
- CVSS 6.4 Medium
authentik allows existing authenticated users to create arbitrary accounts
- authentik
- Privilege escalation
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
authentik vulnerable to Improper Authentication via invitation URL token reuse
- authentik
- Authentication bypass
- CVSS 8.1 High
authentik vulnerable to unauthorized user creation and potential account takeover
- authentik
- Authentication bypass