CVE-2024-21637
High
Description
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.
SeverityHigh
CVSS7.6
Exploit probability—
ProductAuthentik
PublishedJan 11, 2024
First seenJan 11, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- goauthentik authentik2023.8.6, 2023.10.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| goauthentik authentik | 2023.8.0 ≤ v < 2023.8.6, 2023.10.0 ≤ v < 2023.10.6 | 2023.8.6, 2023.10.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.