authentik performs insufficient validation of OAuth scopes (CVE-2024-52287)

Résumé

authentik performs insufficient validation of OAuth scopes

Description d'origine

La description telle que publiée par la source (souvent en anglais).

authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami authentik

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2024.8.5"},{"introduced":"2024.10.0"},{"fixed":"2024.10.3"}]}]

Références

advisory github.com
patch github.com
web nvd.nist.gov