CVE-2024-52287
authentik performs insufficient validation of OAuth scopes
Résumé
authentik performs insufficient validation of OAuth scopes
Description d'origine
La description telle que publiée par la source (souvent en anglais).
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
authentik
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2024.8.5"},{"introduced":"2024.10.0"},{"fixed":"2024.10.3"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com