UpHeron
All vulnerabilities

Servers and applications

CVE-2023-46249

Potential Installation takeover when default admin user is deleted

Severity
Critical 9.8
Published
28 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2023.8.4, 2023.10.2
Also known as
GHSA-rjvp-29xq-f62w
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • Every version before 2023.8.4
  • From 2023.10.0 before 2023.10.2
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2023.8.4
  • Every version before 2023.10.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-46249
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-46249
  • GitHub Advisory Database https://github.com/advisories/GHSA-rjvp-29xq-f62w
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62w