CVE-2023-26481
mediumpriority · track · 26OT risk · elevatedEPSS 0.003 · 20 %ileEUUSEPSS · scored 2026-10-27
authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (11)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- BIT-authentik-2023-26481Insufficient user check in FlowTokens by Email stage2026-04-16vendor · osvUS
authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-26481/cnnvd
- https://github.com/goauthentik/authentik/security/advisories/GHSA-3xf5-pqvf-rqq3cnnvd
- https://goauthentik.io/docs/releases/2023.2#fixed-in-202323cnnvd
- https://github.com/goauthentik/authentik/security/advisories/GHSA-3xf5-pqvf-rqq3enisa_euvd
- https://goauthentik.io/docs/releases/2023.2#fixed-in-202323enisa_euvd
- https://github.com/goauthentik/authentik/security/advisories/GHSA-3xf5-pqvf-rqq3Third Party Advisorynvd
- https://goauthentik.io/docs/releases/2023.2#fixed-in-202323Release Notesnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan