CVE-2023-48228: OAuth2: PKCE can be fully circumvented
authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8.5, authentik checks if the contents of codeverifier is matching only when it is provided. When it is left out completely, authentik simply accepts the token request with out it; even when the flow was started with a codechallenge. authentik 2023.8.5 and 2023.10.4 fix this issue.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-48228?
CVE-2023-48228 is a vulnerability in the OAuth2 implementation of authentik that allows for the circumvention of PKCE (Proof Key for Code Exchange).
What is the severity of CVE-2023-48228?
The severity of CVE-2023-48228 is critical with a CVSS score of 9.8.
How does CVE-2023-48228 affect authentik?
CVE-2023-48228 affects versions of authentik prior to 2023.10.4.
How can the vulnerability be exploited?
The vulnerability can be exploited by requesting an oauth2 flow with a `code_challenge` and `code_method` without checking for a matching and existing `code_verifier` during the token step.
Are there any known fixes for CVE-2023-48228?
Yes, the fix for CVE-2023-48228 can be found in versions 2023.10.4 and later of authentik.