UpHeron
All vulnerabilities

Servers and applications

CVE-2023-26481

Insufficient user check in FlowTokens by Email stage

Severity
Medium 6.5
Published
2 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2022.12.2, 2022.12.3, 2023.1.3, 2023.2.3
Also known as
GHSA-3xf5-pqvf-rqq3
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • Every version before 2022.12.3
  • After 2023.1.0 up to 2023.1.3
  • After 2023.2.0 up to 2023.2.3
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2023.2.3
  • Every version before 2023.1.3
  • Every version before 2022.12.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-26481
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-26481
  • GitHub Advisory Database https://github.com/advisories/GHSA-3xf5-pqvf-rqq3
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-3xf5-pqvf-rqq3