authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any account with a known login or email address. The vulnerability requires the authentik instance to trust X-Forwarded-For header provided by the attacker, thus it is not reproducible from external hosts on a properly configured environment. The issue occurs due to the password stage having a policy bound to it, which skips the password stage if the Identification stage is setup to also contain a password stage. Due to the invalid X-Forwarded-For header, which does not get validated to be an IP Address early enough, the exception happens later and the policy fails. The default blueprint doesn't correctly set `failure_result` to `True` on the policy binding meaning that due to this exception the policy returns false and the password stage is skipped. Versions 2024.8.3 and 2024.6.5 fix this issue.
The password stage verification has an assigned policy that skips this stage if the Identification stage is configured to handle passwords. When an attacker sends an X-Forwarded-For header with an invalid value (e.g., the letter 'a'), IP address validation does not occur early enough — an exception is thrown later, causing a policy execution error. Because the default blueprint incorrectly sets the failure_result parameter to False instead of True in the policy binding, the unhandled exception results in returning false and completely bypassing the password verification stage. The attack is only possible when the authentik instance is configured to trust the X-Forwarded-For header from the attacker.
An attacker knowing a user's login or email address can log into their account without knowing the password, leading to complete account takeover and breach of confidentiality, integrity, and availability of resources protected by authentik.
Update authentik to version 2024.8.3 or 2024.6.5 (depending on the branch used), which contain the fix for this vulnerability. Additionally, as a preventive measure, ensure that the authentik instance does not trust the X-Forwarded-For header from untrusted external sources.
authentik (Goauthentik) in versions earlier than 2024.8.3 and earlier than 2024.6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HGoauthentik Authentik
APPGoauthentik< 2024.6.52024.8.0 – 2024.8.3 (excl.)
Related vulnerabilities
XSS w AutosubmitStage komponentu SFE w Goauthentik Authentik
Pominięcie etapu uwierzytelniania (Source Stage) w Goauthentik Authentik
RCE w authentik przez endpoint testowy mapowania właściwości
authentik — pominięcie uwierzytelnienia przy resetowaniu hasła admina
Authentik: przejęcie konta przez nieprawidłową walidację tokenu odzyskiwania