CVE-2023-26481: Insufficient user check in FlowTokens by Email stage

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-04 · updated 2026-06-17
Weakness: CWE-345

Description

authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2.

Affected products

goauthentik authentik: before 2022.12.3; from 2023.1.0 (excl.) through 2023.1.3; from 2023.2.0 (excl.) through 2023.2.3 — fixed in 2022.12.3

How to fix

Upgrade to a fixed version: goauthentik authentik 2022.12.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26481 or the next vulnerability affects your stack