What is CVE-2024-42490?

CVE-2024-42490 is a high-severity vulnerability in Goauthentik Authentik, classified under Improper Authorization. CVSS score: 7.5/10. Published 2024-08-22.

How severe is CVE-2024-42490?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Goauthentik Authentik

CVE-2024-42490

authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/. Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable. authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue.

EPSS: 0.006 (43.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N.

Affected products

Goauthentik Authentik — versions < 2024.4.4, >= 2024.6.0-rc1, < 2024.6.4

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-42490?: CVE-2024-42490 is a high-severity vulnerability in Goauthentik Authentik, classified under Improper Authorization. CVSS score: 7.5/10. Published 2024-08-22.
How severe is CVE-2024-42490?: High severity. CVSS v3 base score is 7.5 out of 10.