CVE-2023-46249

Summary

CVE-2023-46249 affects versions prior to 2023.8.4 and 2023.10.2 of the open-source Identity Provider, authentik. The vulnerability allows an attacker to reset the password of the default admin user (akadmin) without authentication, if it has been deleted. Authentik uses a blueprint to create the default admin user and optionally sets its password from an environment variable. When the user is deleted, the initial setup flow is reactivated, making the default admin user password vulnerable. This issue is resolved in versions 2023.8.4 and 2023.10.2. A workaround is to ensure the default admin user exists and has a strong password, while it is also possible to deactivate the user to prevent logins as akadmin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.