BIT-authentik-2024-11623

vendorUSosv

Stored XSS in authentik

Advisory ansehen veröffentlicht 2026-04-16Lizenz: per source

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-11623US	medium4.8	0.30% (22nd)	—	2025-02-04
Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons. This action could only be performed by an authenticat…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://cert.pl/en/posts/2025/02/CVE-2024-11623/ADVISORY
https://docs.goauthentik.io/docs/security/audits-and-certs/2024-11-cobalt#svg-images-for-icons-possible-xss-vulnerabilityADVISORY
https://github.com/goauthentik/authentik/pull/12092FIX
https://nvd.nist.gov/vuln/detail/CVE-2024-11623WEB

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan