What’s Vulnerable › Vulnerabilities

CVE-2024-38371: Insufficient access control for OAuth2 Device Code flow in authentik

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-28 · updated 2026-06-17
• Weakness: CWE-284

Description

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.

Affected products

• goauthentik authentik: before 2024.2.4; from 2024.4.0 before 2024.4.3 — fixed in 2024.2.4, 2024.4.3

How to fix

Upgrade to a fixed version: goauthentik authentik 2024.2.4, 2024.4.3. Check the vendor advisory for mitigations.

References

• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0
• https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0
• https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45

Get alerted when CVE-2024-38371 or the next vulnerability affects your stack