Authentication Bypass by Spoofing Affecting github.com/goauthentik/authentik/authentik/providers/oauth2/views package, versions <2023.8.7 >=2023.10.0 <2023.10.7
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMGOAUTHENTIKAUTHENTIKAUTHENTIKPROVIDERSOAUTH2VIEWS-6209999
- published 30 Jan 2024
- disclosed 29 Jan 2024
- credit Unknown
Introduced: 29 Jan 2024
CVE-2024-23647 Open this link in a new tabHow to fix?
Upgrade github.com/goauthentik/authentik/authentik/providers/oauth2/views to version 2023.8.7, 2023.10.7 or higher.
Overview
github.com/goauthentik/authentik/authentik/providers/oauth2/views is an open-source Identity Provider that emphasizes flexibility and versatility. It can be seamlessly integrated into existing environments to support new protocols. authentik is also a great solution for implementing sign-up, recovery, and other similar features in your application, saving you the hassle of dealing with them.
Affected versions of this package are vulnerable to Authentication Bypass by Spoofing due to improper handling of the code_challenge parameter during the authorization process. An attacker can bypass the Proof Key for Code Exchange (PKCE) protection by initiating the authorization request without the code_challenge parameter, potentially leading to code injection attacks.