CVE-2024-21637
XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
Summary
XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
Original description
The description as published by the source.
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with response_mode=form_post. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
authentik
[{"type":"SEMVER","events":[{"introduced":"2023.8.0"},{"fixed":"2023.8.6"},{"introduced":"2023.10.0"},{"fixed":"2023.10.6"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com
- web github.com