Read the docs
TI-2022-22816 Aliases CVE-2022-46172

authentik allows existing authenticated users to create arbitrary accounts

Priority MEDIUM 62CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-287.

Summary

authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00565 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed authentik (goauthentik): 2022.11.4, 2022.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
goauthentikauthentik2022.11.0 to before 2022.11.4; 2022.10.0 to before 2022.10.42022.11.4, 2022.10.4Patch availableCNA
  • authentik Vendorgoauthentik Affected 2022.11.0 to before 2022.11.4; 2022.10.0 to before 2022.10.4 Fixed in 2022.11.4, 2022.10.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*2022.10.0 to before 2022.10.4; 2022.11.0 to before 2022.11.4Vulnerablegoauthentik
  • cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* Versions 2022.10.0 to before 2022.10.4; 2022.11.0 to before 2022.11.4 Vulnerable ·goauthentik

Remediation

  • Fix · CNA authentik (goauthentik) Fixed in 2022.11.4, 2022.10.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46172

References

Exploit 1

  • TI-2026-36603 authentik: SourceStage bypass via empty POST CVSS 3.1CRITICAL 9.8
  • TI-2022-07608 authentik vulnerable to Improper Authentication via invitation URL token reuse CVSS 3.1CRITICAL 9.4
  • TI-2026-36598 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API CVSS 3.1HIGH 8.8
  • TI-2024-25628 Insufficient access control for OAuth2 Device Code flow in authentik CVSS 3.1CRITICAL 9.8
  • TI-2023-24876 authentik potential installation takeover when default admin user is deleted CVSS 3.1CRITICAL 9.8
  • TI-2024-34964 authentik has an insecure default configuration for OAuth2 Redirect URIs CVSS 4.0HIGH 7.9
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences