CVE-2024-52287
authentik performs insufficient validation of OAuth scopes
Summary
authentik performs insufficient validation of OAuth scopes
Original description
The description as published by the source.
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
authentik
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2024.8.5"},{"introduced":"2024.10.0"},{"fixed":"2024.10.3"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com