CVE-2024-23647

Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the codechallenge parameter to the authorization request and adds the codeverifier parameter to the token request. Prior to...

CVE-2024-23647 PKCE downgrade attack in Authentik

Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the codechallenge parameter to the authorization request and adds the codeverifier parameter to the token request. Prior to...

CVE-2024-23647

Authentik (PKCE downgrade) vulnerability (CVE-2024-23647) exists due to a flaw in PKCE implementation: if the authorization request omits code_challenge, PKCE checks are skipped, enabling bypass of PKCE protections. Affected versions are before 2023.8.7 and 2023.10.7. Versions 2023.8.7 and 2023.1...