Improper Input Validation Affecting goauthentik.io package, versions <2022.12.3 >=2023.1.0 <2023.1.3 >=2023.2.0 <2023.2.3
Threat Intelligence
EPSS
0.08% (36th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GOAUTHENTIKIO-3339622
- published 5 Mar 2023
- disclosed 5 Mar 2023
- credit @fuomag9
Introduced: 5 Mar 2023
CVE-2023-26481 Open this link in a new tabHow to fix?
Upgrade goauthentik.io to version 2022.12.3, 2023.1.3, 2023.2.3 or higher.
Overview
Affected versions of this package are vulnerable to Improper Input Validation due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user.
Workaround
For custom recovery flows, it is recommended to add a policy that checks if the flow is restored, and skips the identification stage.
References
CVSS Scores
version 3.1