570 matches found
BIT-AUTHENTIK-2024-47070 authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header
authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. a. This results in a possibility of logging into any account with a known logi...
BIT-AUTHENTIK-2024-38371 Insufficient access control for OAuth2 Device Code flow in authentik
authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been...
BIT-AUTHENTIK-2024-37905 Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...
BIT-AUTHENTIK-2024-23647 PKCE downgrade attack in Authentik
Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the codechallenge parameter to the authorization request and adds the codeverifier parameter to the token request. Prior to...
BIT-AUTHENTIK-2024-21637 XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with responsemode=formpost. This relatively user could use the described attacks to perform a privilege escalation. This...
BIT-AUTHENTIK-2024-11623 Stored XSS in authentik
Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release...
BIT-AUTHENTIK-2023-48228 OAuth2: PKCE can be fully circumvented
authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....
BIT-AUTHENTIK-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...
GHSA-5MF9-H53Q-7MHQ vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...
CVE-2026-4292 vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...
GHSA-933H-HP56-HF7M vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...
CVE-2026-39892 vulnerabilities
Vulnerabilities for packages: gitlab-cng-fips, openstack-kolla-toolbox-2025.2, mlflow, tritonserver-backend-vllm-cuda-13.0, kubeflow-pipelines-visualization-server, pgadmin4-fips, localstack, airflow-core, k8s-sidecar, wazuh-manager, mitmproxy, semgrep, apache-beam-python-3.13-sdk, ggshield,...
GHSA-P423-J2CM-9VMQ vulnerabilities
Vulnerabilities for packages: gitlab-cng-fips, openstack-kolla-toolbox-2025.2, mlflow, tritonserver-backend-vllm-cuda-13.0, kubeflow-pipelines-visualization-server, pgadmin4-fips, localstack, airflow-core, k8s-sidecar, wazuh-manager, mitmproxy, semgrep, apache-beam-python-3.13-sdk, ggshield,...
CVE-2026-33034 vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...
GHSA-PWJP-CCJC-GHWG vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...
CVE-2026-4277 vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...
CVE-2026-3902 vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...
CVE-2026-33033 vulnerabilities
Vulnerabilities for packages: awx, authentik-fips, authentik, label-studio...