Insufficient user check in FlowTokens by Email stage

CVE-2023-26481

What is CVE-2023-26481?

Authentik, an open-source Identity Provider, is affected by a vulnerability that stems from insufficient access checks during the password recovery flow. An attacker can exploit this flaw if a recovery flow has been established by an administrator and if it includes both an Identification and an Email stage. With this setup, the attacker can reset passwords for any user by leveraging incorrectly validated recovery tokens, provided they have access to the recovery link. To mitigate risks, it is crucial to implement policies that verify the integrity of the flow, especially for custom paths. Vulnerable versions are fixed in 2023.2.3, 2023.1.3, and 2022.12.2.

References