PT-2025-1668 · Authentik · Authentik

Daniel Basta · Published 2025-02-04 · Updated 2026-04-16 · CVE-2024-11623

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Authentik versions prior to 2024.10.4

Description The Authentik project is vulnerable to Stored XSS attacks through the upload of crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user.

Recommendations For versions prior to 2024.10.4, update to version 2024.10.4 or later to protect against this risk. As a temporary workaround, consider restricting the upload of SVG files or disabling the feature to upload custom application icons until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-AUTHENTIK-2024-11623

CVE-2024-11623

Affected Products

Authentik

References · 10

• https://github.com/goauthentik/authentik/pull/12092 · Patch
• https://osv.dev/vulnerability/BIT-authentik-2024-11623 · Vendor Advisory
• https://docs.goauthentik.io/docs/security/audits-and-certs/2024-11-cobalt#svg-images-for-icons-possible-xss-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11623 · Security Note
• https://twitter.com/CVEnew/status/1886774234426307031 · Twitter Post
• https://t.me/cvedetector/17200 · Telegram Post
• https://t.me/cveNotify/133066 · Telegram Post
• https://cert.pl/en/posts/2025/02/CVE-2024-11623 · Note
• https://twitter.com/Hossted_OSS/status/1888844207701320181 · Twitter Post