CVE-2024-52287 — authentik performs insufficient validation of OAuth scopes
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with …
Published: 2024-11-21 · CVSS: 6.4 · CVSS 4.0
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7