UpHeron
All vulnerabilities

Servers and applications

CVE-2023-36456

Lack of Proxy IP headers validation

Severity
High 7.3
Published
6 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2023.4.2, 2023.4.3, 2023.5.4, 2023.5.5
Also known as
GHSA-cmxp-jcw7-jjjv
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this. Possible spoofing of IP addresses in logs, downstream applications proxied by…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • Every version before 2023.4.3
  • From 2023.5.0 before 2023.5.5
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2023.5.4
  • Every version before 2023.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-36456
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-36456
  • GitHub Advisory Database https://github.com/advisories/GHSA-cmxp-jcw7-jjjv
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-cmxp-jcw7-jjjv