PT-2024-18987 · Authentik · Authentik

Lauritzh · Published 2024-01-10 · Updated 2026-04-16 · CVE-2024-21637

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Authentik versions prior to 2023.10.6 Authentik versions prior to 2023.8.6

Description Authentik is an open-source Identity Provider that is vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with response mode=form post. This vulnerability could be used to perform a privilege escalation.

Recommendations For versions prior to 2023.10.6, update to version 2023.10.6 or later to resolve the issue. For versions prior to 2023.8.6, update to version 2023.8.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of response mode=form post in OpenID Connect flows until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-AUTHENTIK-2024-21637

CVE-2024-21637

GHSA-RJPR-7W8C-GV3J

Affected Products

Authentik

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21637.json · Exploit
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.6 · Patch
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.6 · Patch
• https://osv.dev/vulnerability/BIT-authentik-2024-21637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21637 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21637 · Vendor Advisory
• https://github.com/goauthentik/authentik/security/advisories/GHSA-rjpr-7w8c-gv3j · Note
• https://t.me/cvenotify/67005 · Telegram Post
• https://twitter.com/CVEnew/status/1745329834094428382 · Twitter Post