PT-2024-29987 · Authentik · Authentik

M2A2 · Published 2024-08-22 · Updated 2026-04-19 · CVE-2024-42490

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.4.4 authentik versions 2024.6.0-rc1 through 2024.6.3 authentik versions prior to 2024.8.0

Description The issue concerns an open-source Identity Provider where several API endpoints can be accessed by users without correct authentication or authorization. The main affected API endpoints are "/api/v3/crypto/certificatekeypairs//view certificate/", "/api/v3/crypto/certificatekeypairs//view private key/", and "/api/v3/.../used by/". These endpoints require knowledge of an object's ID, which is not easily accessible to unprivileged users, especially for certificates, and the IDs are mostly UUIDv4, making them not easily guessable or enumerable.

Recommendations For versions prior to 2024.4.4, update to version 2024.4.4 or later. For versions 2024.6.0-rc1 through 2024.6.3, update to version 2024.6.4 or later. For versions prior to 2024.8.0, update to version 2024.8.0 or later. As a temporary workaround, consider blocking access to the affected API endpoints at a Reverse-proxy/Load balancer level to prevent exploitation.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BIT-AUTHENTIK-2024-42490

CVE-2024-42490

GHSA-QXQC-27PR-WGC8

GO-2024-3085

Affected Products

Authentik

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42490.json · Exploit
• https://github.com/goauthentik/authentik/commit/359b343f51524342a5ca03828e7c975a1d654b11 · Patch
• https://github.com/goauthentik/authentik/security/advisories/GHSA-qxqc-27pr-wgc8 · Vendor Advisory
• https://github.com/goauthentik/authentik/commit/19318d4c00bb02c4ec3c4f8f15ac2e1dbe8d846c · Patch
• https://osv.dev/vulnerability/CVE-2024-42490 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42490 · Security Note
• https://osv.dev/vulnerability/GHSA-qxqc-27pr-wgc8 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-authentik-2024-42490 · Vendor Advisory
• https://github.com/goauthentik/authentik · Note
• https://twitter.com/VulmonFeeds/status/1826696429869383697 · Twitter Post
• https://t.me/cvedetector/3934 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1827971367850971507 · Twitter Post
• https://twitter.com/pulsepatchio/status/2045706419085705582 · Twitter Post
• https://twitter.com/cracbot/status/1828311562601349255 · Twitter Post