CVE-2023-48228

authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to versions 2023.10.4 and 2023.8.5, authentik checks if the contents of `code_verifier` is matching only when it is provided. When it is left out completely, authentik simply accepts the token request with out it; even when the flow was started with a `code_challenge`. authentik 2023.8.5 and 2023.10.4 fix this issue.

• CWE-287

• https://github.com/goauthentik/authentik/blob/dd4e9030b4e667d3720be2feda24c08972602274/authentik/providers/oauth2/views/token.py#L225Product
• https://github.com/goauthentik/authentik/commit/3af77ab3821fe9c7df8055ba5eade3d1ecea03a6Patch
• https://github.com/goauthentik/authentik/commit/6b9afed21f7c39f171a4a445654cfe415bba37d5Patch
• https://github.com/goauthentik/authentik/commit/b88e39411c12e3f9e04125a7887f12354f760a14Patch
• https://github.com/goauthentik/authentik/pull/7666Patch
• https://github.com/goauthentik/authentik/pull/7668Patch
• https://github.com/goauthentik/authentik/pull/7669Patch
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.4Release Notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.5Release Notes
• https://github.com/goauthentik/authentik/security/advisories/GHSA-fm34-v8xq-f2c3Exploit, Vendor Advisory
• https://github.com/goauthentik/authentik/blob/dd4e9030b4e667d3720be2feda24c08972602274/authentik/providers/oauth2/views/token.py#L225Product
• https://github.com/goauthentik/authentik/commit/3af77ab3821fe9c7df8055ba5eade3d1ecea03a6Patch
• https://github.com/goauthentik/authentik/commit/6b9afed21f7c39f171a4a445654cfe415bba37d5Patch
• https://github.com/goauthentik/authentik/commit/b88e39411c12e3f9e04125a7887f12354f760a14Patch
• https://github.com/goauthentik/authentik/pull/7666Patch
• https://github.com/goauthentik/authentik/pull/7668Patch
• https://github.com/goauthentik/authentik/pull/7669Patch
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.4Release Notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.5Release Notes
• https://github.com/goauthentik/authentik/security/advisories/GHSA-fm34-v8xq-f2c3Exploit, Vendor Advisory

Published

Nov 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48222Rundeck is an open source automation service with a web cons…5.4
• CVE-2023-48223fast-jwt provides fast JSON Web Token (JWT) implementation. …5.9
• CVE-2023-48224Fides is an open-source privacy engineering platform for man…9.1
• CVE-2023-48225Laf is a cloud development platform. Prior to version 1.0.0-…9.1
• CVE-2023-48226OpenReplay is a self-hosted session replay suite. In version…3.5
• CVE-2023-48227Umbraco is an ASP.NET content management system (CMS). Start…4.3
• CVE-2023-48229Contiki-NG is an open-source, cross-platform operating syste…7.6
• CVE-2023-4823The WP Meta and Date Remover WordPress plugin before 2.2.0 p…5.4
• CVE-2023-48230Cap'n Proto is a data interchange format and capability-base…9.8
• CVE-2023-48231Vim is an open source command line text editor. When closing…4.3
• CVE-2023-48232Vim is an open source command line text editor. A floating p…4.3
• CVE-2023-48233Vim is an open source command line text editor. If the count…4.3