Description (CNA)
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| goauthentik / authentik | affected < 2024.8.5; affected >= 2024.10.0-rc1, < 2024.10.3 |
CWE
CWE-285
References
- https://github.com/goauthentik/authentik/security/advisories/GHSA-v6m7-8j37-8f4v
- https://github.com/goauthentik/authentik/commit/e9c29e1644e9199b4ba58d2b10eb8c322138eea2
ADP enrichment
No English description supplied.
No references supplied.