CVE-2024-38371: Insufficient access control for OAuth2 Device Code flow in authentik
authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38371?
CVE-2024-38371 is considered a critical severity vulnerability due to unauthorized access risks through an insecure OAuth2 Device code flow.
How do I fix CVE-2024-38371?
To fix CVE-2024-38371, update the authentik software to version 2024.2.4 or later, or to any version in the range from 2024.4.3 to 2024.6.0.
What is the impact of CVE-2024-38371?
The impact of CVE-2024-38371 allows unauthorized users to obtain OAuth tokens which can enable access to sensitive applications.
Which versions of authentik are affected by CVE-2024-38371?
Versions of authentik affected by CVE-2024-38371 are those prior to 2024.2.4 and the versions from 2024.4.3 up to but not including 2024.6.0.
How can I verify if my authentik installation is vulnerable to CVE-2024-38371?
You can verify if your authentik installation is vulnerable to CVE-2024-38371 by checking its version against the affected versions mentioned in the vulnerability details.