UpHeron
All vulnerabilities

Servers and applications

CVE-2024-52307

Timing attack due to a lack of constant time comparison for metrics view

Severity
Medium 6.3
Published
21 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2024.8.5, 2024.10.3
Also known as
GHSA-2xrw-5f2x-m56j
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be accessed directly, as the Go proxy running in the authentik server container fetches data from this…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • Every version before 2024.8.5
  • From 2024.10.0 before 2024.10.3
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2024.10.3
  • Every version before 2024.8.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-52307
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-52307
  • GitHub Advisory Database https://github.com/advisories/GHSA-2xrw-5f2x-m56j
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-2xrw-5f2x-m56j