Is authentik 2023.10.0 affected?

Vulnerabilities affecting 2023.10.0

• 9.8
  CVE-2026-49448 SourceStage bypass via empty POST
• 9.6
  CVE-2023-46249 Potential Installation takeover when default admin user is deleted
• 9.3
  CVE-2026-42849 Reflected XSS in SFE
• 9.1
  CVE-2026-25227 Authenticated Remote Code Execution via Policy/Property Mapping test endpoint fixed in 2025.8.6
• 9.0
  CVE-2024-47070 Password authentication bypass via X-Forwarded-For HTTP header
• 8.9
  CVE-2026-94606 MFA bypass via recipient override in the email authenticator
• 8.8
  CVE-2026-94609 Privilege escalation via delegated group and user management
• 8.8
  CVE-2026-61574 RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries
• 8.8
  CVE-2026-49443 `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API
• 8.8
  CVE-2026-25922 Signature Verification bypass in SAML Source Assertion
• 8.8
  CVE-2024-37905 Improper Authorization for Token modification fixed in 2024.2.4
• 8.7
  CVE-2026-57580 Account Takeover via SAML NameID Comment Truncation
• 8.7
  GHSA-5wcc-hf24-rf5h Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode
• 8.7
  CVE-2026-40165 SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
• 8.6
  CVE-2026-54730 Google Chrome device trust stages can be bypassed
• 8.6
  CVE-2026-25748 Forward authentication bypass with malformed session cookie on Traefik and Caddy
• 8.6
  CVE-2024-38371 Insufficient access control for OAuth2 Device Code flow fixed in 2024.2.4
• 8.5
  CVE-2026-47201 XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
• 8.1
  CVE-2026-94611 Certain stored credentials readable with view permission alone
• 8.1
  CVE-2026-40172 Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
• 8.0
  CVE-2025-29928 Deletion of sessions did not revoke sessions when using database session storage fixed in 2024.12.4
• 7.9
  CVE-2024-52289 Insecure default configuration for OAuth2 Redirect URIs fixed in 2024.8.5
• 7.6
  CVE-2024-21637 XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
• 7.5
  CVE-2026-94613 Denial of Service via Malformed SAML Messages
• 7.5
  CVE-2024-42490 Insufficient Authorization for several API endpoints fixed in 2024.4.4
• 7.4
  CVE-2026-94612 Authentication bypass in SAML Sources via assertion confusion and replay
• 7.4
  GHSA-3wf5-rj6w-7527 OAuth2 Redirect URI Poisoning via Auto-Save on Unconfigured Provider
• 7.1
  CVE-2025-53942 Insufficient check for account active status when authenticating with OAuth/SAML Sources fixed in 2025.4.4
• 6.5
  CVE-2025-52553 Insufficient Session verification for Remote Access Control endpoint access fixed in 2025.4.3
• 6.5
  CVE-2024-23647 PKCE downgrade attack in authentik
• 6.4
  CVE-2024-52287 Insufficient validation of OAuth scopes for client_credentials and device_code grants fixed in 2024.8.5
• 6.3
  CVE-2024-52307 Timing attack due to a lack of constant time comparison for metrics view fixed in 2024.8.5
• 5.8
  CVE-2025-64708 Invitation expiry is delayed by at least 5 minutes
• 5.4
  GHSA-hmrg-vpp4-gj88 Broken access control in Shared Signals Framework stream management
• 5.3
  CVE-2026-55106 LDAP Source debug endpoint accessible without authorization
• 4.8
  CVE-2025-64521 Deactivated service account can authenticate to OAuth
• medium
  CVE-2026-41569 WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints
• medium
  CVE-2026-41577 SAML source does not validate Conditions, timing, or audience on assertions
• high
  CVE-2026-40166 Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
• high
  CVE-2024-47077 Insufficient cross-provider token validation during introspection
• high
  CVE-2023-48228 OAuth2: Insufficient PKCE check

Newer releases