Authentik lacks Proxy IP headers validation
CVE-2023-36456
What is CVE-2023-36456?
The authentik Identity Provider prior to versions 2023.4.3 and 2023.5.5 is susceptible to a vulnerability due to the lack of verification for the X-Forwarded-For and X-Real-IP headers. This exposes systems directly accessible by users to risks including spoofing of IP addresses in logs and downstream applications, potentially allowing attackers to bypass security checks dependent on IP verification. This compromise undermines the reliability of session logs and may affect the integrity of security policies, particularly in scenarios where user IP addresses dictate authentication flows. Versions 2023.4.3 and 2023.5.5 include patches that address this issue.
Affected Version(s)
authentik < 2023.4.3 < 2023.4.3
authentik >= 2023.5.0, < 2023.5.5 < 2023.5.0, 2023.5.5