CVE-2024-11623 Stored XSS in authentik

What is CVE-2024-11623?

CVE-2024-11623 is a medium-severity cross-site scripting vulnerability in goauthentik authentik, published on 4 Feb 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.  This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.

Weakness: CWE-79

Which versions are affected by CVE-2024-11623?

1 open source package ship an affected version, including authentik. It affects 1 product.

Products include Goauthentik Authentik.

How do I fix CVE-2024-11623?

Upgrade authentik to 2024.10.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-11623 being exploited?

There is no known exploitation of CVE-2024-11623 in the wild and no public exploit code.

Other vulnerabilities in goauthentik authentik

• CVE-2026-49448 authentik: SourceStage bypass via empty POST Critical 9.8
• CVE-2023-46249 authentik potential installation takeover when default admin user is deleted Critical 9.7
• CVE-2022-23555 authentik vulnerable to Improper Authentication via invitation URL token reuse Critical 9.4
• CVE-2026-42849 authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover Critical 9.3
• CVE-2026-25227 authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-authentik-2024-11623, GHSA-f8wx-qvvq-mwx4.