// For flags

CVE-2023-46249

authentik potential installation takeover when default admin user is deleted

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.

authentik es un proveedor de identidades de código abierto. Antes de las versiones 2023.8.4 y 2023.10.2, cuando se eliminaba el usuario administrador predeterminado, era posible que un atacante estableciera la contraseña del usuario administrador predeterminado sin ninguna autenticación. authentik utiliza un modelo para crear el usuario administrador predeterminado, que también puede establecer opcionalmente la contraseña de los usuarios administradores predeterminados desde una variable de entorno. Cuando se elimina el usuario, el flujo de "configuración inicial" utilizado para configurar authentik después de la primera instalación vuelve a estar disponible. authentik 2023.8.4 y 2023.10.2 solucionan este problema. Como workaround, asegúrese de que el usuario administrador predeterminado (nombre de usuario `akadmin`) exista y tenga una contraseña establecida. Se recomienda utilizar una contraseña muy segura para este usuario y guardarla en un lugar seguro como un administrador de contraseñas. También es posible desactivar el usuario para evitar inicios de sesión como akaadmin.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-10-19 CVE Reserved
  • 2023-10-31 CVE Published
  • 2024-09-05 CVE Updated
  • 2025-02-04 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
  • CWE-306: Missing Authentication for Critical Function
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Goauthentik
Search vendor "Goauthentik"
 Authentik
Search vendor "Goauthentik" for product "Authentik"
 < 2023.8.4
Search vendor "Goauthentik" for product "Authentik" and version " < 2023.8.4"
-
Affected
Goauthentik
Search vendor "Goauthentik"
 Authentik
Search vendor "Goauthentik" for product "Authentik"
 >= 2023.10.0 < 2023.10.2
Search vendor "Goauthentik" for product "Authentik" and version " >= 2023.10.0 < 2023.10.2"
-
Affected