BIT-authentik-2024-11623

vendorUSosv

Stored XSS in authentik

view advisory published 2026-04-16Licence: per source

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-11623US	medium4.8	0.30% (22nd)	—	2025-02-04
Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticat…

references

External citations — patches, advisories, analysis.

https://cert.pl/en/posts/2025/02/CVE-2024-11623/ADVISORY
https://docs.goauthentik.io/docs/security/audits-and-certs/2024-11-cobalt#svg-images-for-icons-possible-xss-vulnerabilityADVISORY
https://github.com/goauthentik/authentik/pull/12092FIX
https://nvd.nist.gov/vuln/detail/CVE-2024-11623WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan