pkg:Bitnami/authentik

所有已知漏洞

• CRITICAL9.8CVE-2024-38371Insufficient access control for OAuth2 Device Code flow in authentik
  from 0, < 2024.6.0
• CRITICAL9.8CVE-2023-48228OAuth2: PKCE can be fully circumvented
  from 0, < 2023.8.5, >= 2023.10.0, < 2023.10.4
• CRITICAL9.8CVE-2023-46249authentik potential installation takeover when default admin user is deleted
  from 0, < 2023.8.4, >= 2023.10.0, < 2023.10.2
• CRITICAL9.8CVE-2022-46145authentik vulnerable to unauthorized user creation and potential account takeover
  from 0, < 2022.10.2, >= 2022.11.0, < 2022.11.2
• CRITICAL9.0CVE-2024-47070authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header
  from 0, < 2024.6.5, >= 2024.8.0, < 2024.8.3
• HIGH8.8CVE-2026-25922authentik has a Signature Verification Bypass via SAML Assertion Wrapping
  from 0, < 2025.8.6, >= 2025.10.0, < 2025.12.4
• HIGH8.8CVE-2024-37905Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
  from 0, < 2024.6.0
• HIGH8.8CVE-2022-23555authentik vulnerable to Improper Authentication via invitation URL token reuse
  from 0, < 2022.10.4, >= 2022.11.0, < 2022.11.4
• HIGH8.7CVE-2026-40165authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation
  from 0, < 2025.12.5, >= 2026.2.0, < 2026.2.3
• HIGH8.7CVE-2024-42490authentik has Insufficient Authorization for several API endpoints
  from 0, < 2024.4.4, >= 2024.6.0, < 2024.6.4
• HIGH8.1CVE-2026-40172authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
  from 0, < 2025.12.5, >= 2026.2.0, < 2026.2.3
• HIGH8.0CVE-2025-29928authentik's deletion of sessions did not revoke sessions when using database session storage
  from 0, < 2024.12.4, >= 2025.0.0, < 2025.2.3
• HIGH7.5CVE-2026-25748authentik has a forward authentication bypass with broken cookie
  >= 2025.10.0, < 2025.12.4
• HIGH7.3CVE-2023-36456Authentik lacks Proxy IP headers validation
  from 0, < 2023.4.3, >= 2023.5.0, < 2023.5.5
• HIGH7.2CVE-2026-25227authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint
  >= 2021.3.1, < 2025.8.6, >= 2025.10.0, < 2025.12.4
• MEDIUM6.5CVE-2024-47077authentik cross-provider token validation problems
  from 0, < 2024.6.5, >= 2024.8.0, < 2024.8.3
• MEDIUM6.5CVE-2023-26481Insufficient user check in FlowTokens by Email stage
  from 0, < 2022.12.3 | >= 2023.1.0, <= 2023.1.3, >= 2023.2.0, <= 2023.2.3
• MEDIUM6.5CVE-2024-23647PKCE downgrade attack in Authentik
  from 0, < 2023.8.7, >= 2023.10.0, < 2023.10.7
• MEDIUM6.4CVE-2022-46172authentik allows existing authenticated users to create arbitrary accounts
  >= 2022.10.0, < 2022.10.4, >= 2022.11.0, < 2022.11.4
• MEDIUM5.8CVE-2025-64708authentik invitation expiry is delayed by at least 5 minutes
  from 0, < 0.0.0-20251119135424-6672e6aaa41e, >= 2000.0.0, < 2025.8.5, >= 2025.9.0, < 2025.10.2
• MEDIUM5.4CVE-2024-21637XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
  >= 2023.8.0, < 2023.8.6, >= 2023.10.0, < 2023.10.6
• MEDIUM5.3CVE-2023-39522Username enumeration attack in goauthentik
  from 0, < 2023.5.6, >= 2023.6.0, < 2023.6.2
• MEDIUM4.8CVE-2025-64521authentik deactivated service accounts can authenticate to OAuth
  from 0, < 0.0.0-20251119140106-9dbdfc3f1be0, >= 2000.0.0, < 2025.8.5, >= 2025.9.0, < 2025.10.2
• —CVE-2026-40166authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
  from 0, < 2025.12.5, >= 2026.2.0, < 2026.2.3
• —CVE-2025-52553authentik has Insufficient Session verification for Remote Access Control endpoint access
  from 0, < 2025.4.3, >= 2025.6.0, < 2025.6.3
• —CVE-2024-52307authentik allows a timing attack due to missing constant time comparison for metrics view
  from 0, < 2024.8.5, >= 2024.10.0, < 2024.10.3
• —CVE-2024-52289authentik has an insecure default configuration for OAuth2 Redirect URIs
  from 0, < 2024.8.5, >= 2024.10.0, < 2024.10.3
• —CVE-2024-52287authentik performs insufficient validation of OAuth scopes
  from 0, < 2024.8.5, >= 2024.10.0, < 2024.10.3
• —CVE-2024-11623Stored XSS in authentik
  from 0, < 2024.10.4
• —CVE-2025-53942authentik has an insufficient check for account active status during OAuth/SAML authentication
  from 0, < 2025.4.4, >= 2025.6.0, < 2025.6.4