PT-2023-25576 · Authentik · Authentik

Thijsa

·

Published

2023-07-06

·

Updated

2026-04-16

·

CVE-2023-36456

CVSS v3.1

8.3

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.4.3 and 2023.5.5
Description The issue concerns the lack of verification of the source of the X-Forwarded-For and X-Real-IP headers in authentik, an open-source Identity Provider. This poses a security risk when flows or policies check the user's IP address, such as ignoring 2-factor authentication when connected to a company network. Additionally, IP addresses in logfiles and user sessions become unreliable, and anybody can spoof this address. The header is also passed on to proxied applications behind an outpost, allowing for potential verification, logging, blocking, or rate limiting based on the IP address to be overridden.
Recommendations For versions prior to 2023.4.3, update to version 2023.4.3 or later to resolve the issue. For versions prior to 2023.5.5, update to version 2023.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the X-Forwarded-For and X-Real-IP headers until a patch is applied.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BIT-AUTHENTIK-2023-36456
CVE-2023-36456
GHSA-CMXP-JCW7-JJJV

Affected Products

Authentik