fkie_cve-2024-47077
Vulnerability from fkie_nvd
Published
2024-09-27 16:15
Modified
2025-08-21 19:28
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued for one application and use it to access another application that they aren't allowed to access. Anyone who has more than one proxy provider application with different trust domains or different access control is affected. Versions 2024.8.3 and 2024.6.5 fix the issue.
References
security-advisories@github.comhttps://github.com/goauthentik/authentik/blob/70b5a214f2e7205572f914aaf68682501b9f5945/authentik/providers/oauth2/views/introspection.py#L42-L51Product
security-advisories@github.comhttps://github.com/goauthentik/authentik/blob/70b5a214f2e7205572f914aaf68682501b9f5945/internal/outpost/proxyv2/application/auth_bearer.go#L30-L36Product
security-advisories@github.comhttps://github.com/goauthentik/authentik/commit/22e586bd8cdc3d1db8a0f18314d76f82371129b2Patch
security-advisories@github.comhttps://github.com/goauthentik/authentik/commit/57a31b5dd16d4adce716b9878455c0d6f58155fePatch
security-advisories@github.comhttps://github.com/goauthentik/authentik/security/advisories/GHSA-8gfm-pr6x-pfh9Vendor Advisory
Impacted products
Vendor Product Version
goauthentik authentik *
goauthentik authentik *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "64784B4C-46C6-4F7A-947B-167A29072B70",
              "versionEndExcluding": "2024.6.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "424378D1-E5DB-446E-AC2A-05BF49F0EF44",
              "versionEndExcluding": "2024.8.3",
              "versionStartIncluding": "2024.8.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued for one application and use it to access another application that they aren\u0027t allowed to access. Anyone who has more than one proxy provider application with different trust domains or different access control is affected. Versions 2024.8.3 and 2024.6.5 fix the issue."
    },
    {
      "lang": "es",
      "value": "authentik es un proveedor de identidad de c\u00f3digo abierto. Antes de las versiones 2024.8.3 y 2024.6.5, los tokens de acceso emitidos para una aplicaci\u00f3n pueden ser robados por esa aplicaci\u00f3n y utilizados para hacerse pasar por el usuario frente a cualquier otro proveedor de proxy. Adem\u00e1s, un usuario puede robar un token de acceso que se le emiti\u00f3 leg\u00edtimamente para una aplicaci\u00f3n y utilizarlo para acceder a otra aplicaci\u00f3n a la que no tiene permitido acceder. Cualquier persona que tenga m\u00e1s de una aplicaci\u00f3n de proveedor de proxy con diferentes dominios de confianza o diferentes controles de acceso se ve afectada. Las versiones 2024.8.3 y 2024.6.5 solucionan el problema."
    }
  ],
  "id": "CVE-2024-47077",
  "lastModified": "2025-08-21T19:28:20.653",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-27T16:15:06.043",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/goauthentik/authentik/blob/70b5a214f2e7205572f914aaf68682501b9f5945/authentik/providers/oauth2/views/introspection.py#L42-L51"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/goauthentik/authentik/blob/70b5a214f2e7205572f914aaf68682501b9f5945/internal/outpost/proxyv2/application/auth_bearer.go#L30-L36"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/goauthentik/authentik/commit/22e586bd8cdc3d1db8a0f18314d76f82371129b2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/goauthentik/authentik/commit/57a31b5dd16d4adce716b9878455c0d6f58155fe"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-8gfm-pr6x-pfh9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.