CVE-2024-23647 PKCE downgrade attack in Authentik

Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the codechallenge parameter to the authorization request and adds the codeverifier parameter to the token request. Prior to...

Authentication Bypass

Authentik is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of the codechallenge parameter from the PKCE authorization request. This issue can be exploited by an attacker by removing the codechallenge parameter resulting in authentication downgrade...

GHSA-MRX3-GXJX-HJQJ Authentik vulnerable to PKCE downgrade attack

Summary PKCE is a very important countermeasure in OAuth2 , both for public and confidential clients. It protects against CSRF attacks and code injection attacks. Because of this bug, an attacker can circumvent the protection PKCE offers. Patches authentik 2023.8.7 and 2023.10.7 fix this issue...

PT-2024-19998

Name of the Vulnerable Software and Affected Versions Authentik versions prior to 2023.8.7 Authentik versions prior to 2023.10.7 Description Authentik is an open-source Identity Provider with a bug in its implementation of PKCE, allowing an attacker to circumvent the protection that PKCE offers...

RHCOS 4 : OpenShift Container Platform 4.9.56 (RHSA-2023:0777)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0777 advisory. - google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper...

Security Bulletin: There is a vulnerability in google-oauth-client-1.25.0.jar used by IBM Maximo Asset Management application (CVE-2020-7692 and CVE-2021-22573)

Summary Security Bulletin: There is a vulnerability in google-oauth-client-1.25.0.jar used by IBM Maximo Asset Management application CVE-2020-7692 and CVE-2021-22573 Vulnerability Details CVEID:CVE-2020-7692 DESCRIPTION: Google APIs google-oauth-java-client could allow a remote attacker to bypas...

CVE-2023-50714

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...

Cross site request forgery (csrf)

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...

CVE-2023-50714 The Oauth2 PKCE implementation is vulnerable

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...

CVE-2023-50714 The Oauth2 PKCE implementation is vulnerable

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...

CVE-2023-50714

The vulnerability CVE-2023-50714 affects yii2-authclient (Yii framework 2.x) prior to version 2.2.15. The PKCE-protected OAuth2 implementation has two issues: (1) the authCodeVerifier should be removed after use (like authState), and (2) a downgrade attack risk if PKCE is relied upon for CSRF pro...

CVE-2023-50714 The Oauth2 PKCE implementation is vulnerable

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...

PKCE Downgrade Attack

yiisoft/yii2-authclient is vulnerable to PKCE Downgrade Attack. The vulnerability is caused due to an insecure implementation of PKCE. The application doesn't use authCodeVerifier securely. An attacker can gain unauthorized access to protected resources by exploiting this vulnerability...

yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable

Impact What kind of vulnerability is it? Who is impacted? Original Report: The Oauth2 PKCE implementation is vulnerable in 2 ways: 1. The authCodeVerifier should be removed after usage similar to 'authState' 2. There is a risk for a "downgrade attack" if PKCE is being relied on for CSRF protectio...

GHSA-RW54-6826-C8J5 yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable

Impact What kind of vulnerability is it? Who is impacted? Original Report: The Oauth2 PKCE implementation is vulnerable in 2 ways: 1. The authCodeVerifier should be removed after usage similar to 'authState' 2. There is a risk for a "downgrade attack" if PKCE is being relied on for CSRF protectio...

Authentication Bypass

authentik is vulnerable to authentication bypass due to an insufficient PKCE check. The vulnerability is caused by codeverifier step during the OAUTH initialisation flow. Authentik improperly accepts the token request when codeverifier is omitted, even when the flow was started with a...

CVE-2023-48228

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228 OAuth2: PKCE can be fully circumvented

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228

CVE-2023-48228 affects the authentik open-source IDP. The vulnerability is in the PKCE code_verifier validation during OAuth2 token exchange: prior to versions 2023.10.4 and 2023.8.5, authentik accepted a token request without verifying the code_verifier even when a code_challenge was used. The i...

Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code

Impact Dex instances with public clients and by extension, clients accepting tokens issued by those Dex instances are affected by this vulnerability. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the...