TI-2024-34964 Aliases CVE-2024-52289

authentik has an insecure default configuration for OAuth2 Redirect URIs

MEDIUM 45CWE-185Published 2024-11-21 · Updated 2025-09-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirect_uri value received as an allowed redirect URI, without escaping characters that have a special meaning in RegEx. Similarly, the documentation did not take this into consideration either. Given a provider with the Redirect URIs set to https://foo.example.com, an attacker can register a domain fooaexample.com, and it will correctly pass validation. authentik 2024.8.5 and 2024.10.3 fix this issue. As a workaround, When configuring OAuth2 providers, make sure to escape any wildcard characters that are not intended to function as a wildcard, for example replace `.` with `\.`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01091 65th percentileScored 2026-11-07

Fix Fixed authentik (goauthentik): 2024.8.5, 2024.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
goauthentik	authentik	before 2024.8.5; 2024.10.0-rc1 to before 2024.10.3	2024.8.5, 2024.10.3	Patch available	CNA

authentik Vendorgoauthentik Affected before 2024.8.5; 2024.10.0-rc1 to before 2024.10.3 Fixed in 2024.8.5, 2024.10.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:goauthentik:authentik::::::::	before 2024.8.5; 2024.10.0 to before 2024.10.3	Vulnerable	goauthentik

cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* Versions before 2024.8.5; 2024.10.0 to before 2024.10.3 Vulnerable ·goauthentik

Remediation

Fix · CNA authentik (goauthentik) Fixed in 2024.8.5, 2024.10.3

Timeline

2026-10-02 Threatist record created from CVE-2024-52289

References

Patch 1

https://github.com/goauthentik/authentik/commit/85bb638243c8d7ea42ddd3b15b3f51a90d2b8c54

Advisory 1

https://github.com/goauthentik/authentik/security/advisories/GHSA-3q5w-6m3x-64gj

TI-2026-36603 authentik: SourceStage bypass via empty POST CVSS 3.1CRITICAL 9.8
TI-2022-07608 authentik vulnerable to Improper Authentication via invitation URL token reuse CVSS 3.1CRITICAL 9.4
TI-2026-36598 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API CVSS 3.1HIGH 8.8
TI-2022-22816 authentik allows existing authenticated users to create arbitrary accounts CVSS 3.1MEDIUM 6.4
TI-2024-25628 Insufficient access control for OAuth2 Device Code flow in authentik CVSS 3.1CRITICAL 9.8
TI-2023-24876 authentik potential installation takeover when default admin user is deleted CVSS 3.1CRITICAL 9.8

See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences