CVE-2023-48228

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228

CVE-2023-48228 affects the authentik open-source IDP. The vulnerability is in the PKCE code_verifier validation during OAuth2 token exchange: prior to versions 2023.10.4 and 2023.8.5, authentik accepted a token request without verifying the code_verifier even when a code_challenge was used. The i...