CVE-2022-46172

authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4.

• CWE-269
• CWE-287
• CWE-269
• CWE-287

• https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5Exploit, Third Party Advisory
• https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5Exploit, Third Party Advisory

Published

Dec 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46167Capsule is a multi-tenancy and policy-based framework for Ku…8.8
• CVE-2022-46168Discourse is an option source discussion platform. Prior to …3.5
• CVE-2022-46169Cacti is an open source platform which provides a robust and…9.8
• CVE-2022-4617Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
• CVE-2022-46170CodeIgniter is a PHP full-stack web framework. When an appli…9.8
• CVE-2022-46171Tauri is a framework for building binaries for all major des…7.7
• CVE-2022-46173Elrond-GO is a go implementation for the Elrond Network prot…6.5
• CVE-2022-46174efs-utils is a set of Utilities for Amazon Elastic File Syst…4.2
• CVE-2022-46175JSON5 is an extension to the popular JSON file format that a…8.8
• CVE-2022-46176Cargo is a Rust package manager. The Rust Security Response …5.9
• CVE-2022-46177Discourse is an option source discussion platform. Prior to …8.1
• CVE-2022-46178MeterSphere is a one-stop open source continuous testing pla…8.8