Archived

This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.

Jens L aa874dd92a

security: fix CVE-2023-39522 (#6665 )

* stages/email: don't disclose whether a user exists or not when recovering

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* update website

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

2023-08-29 19:07:49 +02:00

769 B

Raw Blame History

CVE-2023-39522

Reported by @markrassamni

Username enumeration attack

Summary

Using a recovery flow with an identification stage an attacker is able to determine if a username exists.

Patches

authentik 2023.5.6 and 2023.6.2 fix this issue.

Impact

Only setups configured with a recovery flow are impacted by this.

Details

An attacker can easily enumerate and check users' existence using the recovery flow, as a clear message is shown when a user doesn't exist. Depending on configuration this can either be done by username, email, or both.

For more information

If you have any questions or comments about this advisory:

Email us at security@goauthentik.io

769 B Raw Blame History