CVE-2024-52287 authentik performs insufficient validation of OAuth scopes

What is CVE-2024-52287?

CVE-2024-52287 is a medium-severity missing authorization vulnerability in goauthentik authentik, published on 21 Nov 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.

Weakness: CWE-285

Which versions are affected by CVE-2024-52287?

1 open source package ship an affected version, including authentik. It affects 1 product.

Products include Goauthentik Authentik.

How do I fix CVE-2024-52287?

Upgrade authentik to a fixed version for your release line: 2024.8.5 or 2024.10.3.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-52287 being exploited?

There is no known exploitation of CVE-2024-52287 in the wild and no public exploit code.

Other vulnerabilities in goauthentik authentik

• CVE-2026-49448 authentik: SourceStage bypass via empty POST Critical 9.8
• CVE-2023-46249 authentik potential installation takeover when default admin user is deleted Critical 9.7
• CVE-2022-23555 authentik vulnerable to Improper Authentication via invitation URL token reuse Critical 9.4
• CVE-2026-42849 authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover Critical 9.3
• CVE-2026-25227 authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-authentik-2024-52287, GHSA-v6m7-8j37-8f4v.