CVE-2024-21637 XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode
Attackers can execute arbitrary scripts via JavaScript URIs in OpenID Connect flows, potentially leading to privilege escalation in Authentik.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-21637?
CVE-2024-21637 is a high-severity cross-site scripting vulnerability in goauthentik authentik, published on 11 Jan 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.
Weakness: CWE-79
Which versions are affected by CVE-2024-21637?
1 open source package ship an affected version, including authentik. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authentik Bitnami | From 2023.8.0 | 2023.8.6, 2023.10.6 |
Products include Goauthentik Authentik.
How do I fix CVE-2024-21637?
Upgrade authentik to a fixed version for your release line: 2023.8.6 or 2023.10.6.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-21637 being exploited?
There is no known exploitation of CVE-2024-21637 in the wild and no public exploit code.
Other vulnerabilities in goauthentik authentik
- CVE-2026-49448 authentik: SourceStage bypass via empty POST
- CVE-2023-46249 authentik potential installation takeover when default admin user is deleted
- CVE-2022-23555 authentik vulnerable to Improper Authentication via invitation URL token reuse
- CVE-2026-42849 authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover
- CVE-2026-25227 authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint
Sources
Also known as BIT-authentik-2024-21637, GHSA-rjpr-7w8c-gv3j.