UpHeron
All vulnerabilities

Servers and applications

CVE-2023-39522

Username enumeration attack

Severity
Medium 5.3
Published
29 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2023.5.6, 2023.6.2
Also known as
GHSA-vmf9-6pcv-xr87
Sources
NVD, Project advisories (GitHub)

Description

goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a username exists. Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recovery flow described above is susceptible to having their username/email revealed as existing. An…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • Every version before 2023.5.6
  • From 2023.6.0 before 2023.6.2
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2023.6.2
  • Every version before 2023.5.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39522
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39522
  • GitHub Advisory Database https://github.com/advisories/GHSA-vmf9-6pcv-xr87
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-vmf9-6pcv-xr87