CVE-2023-46249

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.

• CWE-287
• CWE-306

• https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0Patch
• https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fcPatch
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2Release Notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4Release Notes
• https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62wVendor Advisory
• https://github.com/goauthentik/authentik/commit/261879022d25016d58867cf1f24e90b81ad618d0Patch
• https://github.com/goauthentik/authentik/commit/ea75741ec22ecef34bc7073f1163e17a8a2bf9fcPatch
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.2Release Notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.4Release Notes
• https://github.com/goauthentik/authentik/security/advisories/GHSA-rjvp-29xq-f62wVendor Advisory

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46243XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46244XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-46245Kimai is a web-based multi-user time-tracking application. V…7.2
• CVE-2023-46246Vim is an improved version of the good old UNIX editor Vi. H…5.5
• CVE-2023-46247Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2023-46248Cody is an artificial intelligence (AI) coding assistant. Th…8.8
• CVE-2023-4625Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-46250pypdf is a free and open-source pure-python PDF library. An …5.5
• CVE-2023-46251 MyBB is a free and open source forum software. Custom MyCod…6.1
• CVE-2023-46252Squidex is an open source headless CMS and content managemen…6.1
• CVE-2023-46253Squidex is an open source headless CMS and content managemen…7.2
• CVE-2023-46254capsule-proxy is a reverse proxy for Capsule kubernetes mult…4.3