CVE-2024-52289
authentik has an insecure default configuration for OAuth2 Redirect URIs
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
authentik has an insecure default configuration for OAuth2 Redirect URIs
authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirect_uri value received as an allowed redirect URI, without escaping characters that have a special meaning in RegEx. Similarly, the documentation did not take this into consideration either. Given a provider with the Redirect URIs set to https://foo.example.com, an attacker can register a domain fooaexample.com, and it will correctly pass validation. authentik 2024.8.5 and 2024.10.3 fix this issue. As a workaround, When configuring OAuth2 providers, make sure to escape any wildcard characters that are not intended to function as a wildcard, for example replace `.` with `\.`.
Reserved 2024-11-06 | Published 2024-11-21 | Updated 2024-11-21 | Assigner GitHub_MCWE-185: Incorrect Regular Expression
github.com/...hentik/security/advisories/GHSA-3q5w-6m3x-64gj
github.com/...ommit/85bb638243c8d7ea42ddd3b15b3f51a90d2b8c54
Support options
