Goauthentik vulnerabilities
45 CVEs and advisories name Goauthentik as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-47077authentik cross-provider token validation problems
- CVE-2024-47070authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header
- CVE-2024-42490authentik has Insufficient Authorization for several API endpoints
- CVE-2024-38371Insufficient access control for OAuth2 Device Code flow in authentik
- CVE-2024-37905Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
- CVE-2024-23647PKCE downgrade attack in Authentik
- CVE-2024-21637XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
- CVE-2023-48228OAuth2: PKCE can be fully circumvented
- CVE-2023-46249authentik potential installation takeover when default admin user is deleted
- CVE-2023-39522Username enumeration attack in goauthentik
- CVE-2023-36456Authentik lacks Proxy IP headers validation
- CVE-2023-26481Insufficient user check in FlowTokens by Email stage
- CVE-2022-46172authentik allows existing authenticated users to create arbitrary accounts
- CVE-2022-23555authentik vulnerable to Improper Authentication via invitation URL token reuse
- CVE-2022-46145authentik vulnerable to unauthorized user creation and potential account takeover