BIT-authentik-2024-47077

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/authentik/BIT-authentik-2024-47077.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-authentik-2024-47077
Aliases
Published
2026-04-16T23:36:19.464Z
Modified
2026-04-17T04:57:14.627101381Z
Summary
authentik cross-provider token validation problems
Details

authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued for one application and use it to access another application that they aren't allowed to access. Anyone who has more than one proxy provider application with different trust domains or different access control is affected. Versions 2024.8.3 and 2024.6.5 fix the issue.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:go:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / authentik

Package

Name
authentik
Purl
pkg:bitnami/authentik

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2024.6.5
Introduced
2024.8.0
Fixed
2024.8.3

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/authentik/BIT-authentik-2024-47077.json"