CVE-2024-52287: authentik performs insufficient validation of OAuth scopes

Q: What is the severity of CVE-2024-52287?

CVE-2024-52287 is considered a medium severity vulnerability due to the potential unauthorized access to tokens.

Q: How do I fix CVE-2024-52287?

To fix CVE-2024-52287, update authentik to version 2024.8.5 or 2024.10.3.

Q: What configurations are affected by CVE-2024-52287?

CVE-2024-52287 affects the OAuth client_credentials and device_code grants, allowing tokens to be issued with incorrectly configured scopes.

Q: Who is affected by CVE-2024-52287?

Organizations using authentik versions 2024.8.5 through 2024.10.3 are affected by CVE-2024-52287.

Q: What software does CVE-2024-52287 impact?

CVE-2024-52287 impacts the authentik identity provider software.

Published Nov 21, 2024

Updated

authentik is an open-source identity provider. When using the clientcredentials or devicecode OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.

Affected Software

3 affected components

Authentik Authentik>=2024.8.5<=2024.10.3

goauthentik Authentik<2024.8.5

goauthentik Authentik>=2024.10.0<2024.10.3

Remediation

Patch Available

https://github.com/goauthentik/authentik/commit/e9c29e1644e9199b4ba58d2b10eb8c322138eea2

Event History

Nov 21, 2024

CVE Published

via MITRE·05:23 PM

Data Sourced

via MITRE·05:23 PM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Mar 31, 57609

Event

via NVD·12:53 PM

Frequently Asked Questions

What is the severity of CVE-2024-52287?

CVE-2024-52287 is considered a medium severity vulnerability due to the potential unauthorized access to tokens.

How do I fix CVE-2024-52287?