CVE-2024-52307: authentik allows a timing attack due to missing constant time comparison for metrics view

Severity: medium (CVSS 5.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-21 · updated 2026-06-17
Weakness: CWE-208

Description

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRET_KEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be accessed directly, as the Go proxy running in the authentik server container fetches data from this endpoint and serves it on a separate port (9300 by default), which can be scraped by Prometheus without being exposed publicly. authentik 2024.8.5 and 2024.10.3 fix this issue. Since the /-/metrics/ endpoint is not intended to be accessed publicly, requests to the endpoint can be blocked by the reverse proxy/load balancer used in conjunction with authentik.

Affected products

goauthentik authentik: before 2024.8.5; from 2024.10.0 before 2024.10.3 — fixed in 2024.10.3, 2024.8.5

How to fix

Upgrade to a fixed version: goauthentik authentik 2024.10.3, 2024.8.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-52307 or the next vulnerability affects your stack