CVE-2023-48228highCWE-287

CVE-2023-48228: fallo de gravedad alta en goauthentik authentik

OAuth2: PKCE can be fully circumvented

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear authentik

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.2%
authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to versions 2023.10.4 and 2023.8.5, authentik checks if the contents of `code_verifier` is matching only when it is provided. When it is left out completely, authentik simply accepts the token request with out it; even when the flow was started with a `code_challenge`. authentik 2023.8.5 and 2023.10.4 fix this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
goauthentik · authentik
CVEs relacionadas — goauthentik authentik

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-46145HIGHauthentik vulnerable to unauthorized user creation and potential account takeoverEPSS 1.3%CVE-2024-52289HIGHauthentik has an insecure default configuration for OAuth2 Redirect URIsEPSS 1.1%CVE-2022-23555CRITICALauthentik vulnerable to Improper Authentication via invitation URL token reuseEPSS 0.9%CVE-2026-25227CRITICALauthentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test EndpointEPSS 0.9%CVE-2023-46249CRITICALauthentik potential installation takeover when default admin user is deletedEPSS 0.8%CVE-2023-36456HIGHAuthentik lacks Proxy IP headers validationEPSS 0.8%