Security Advisory

CVE-2024-21637

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2024-01-11 05:49:44

Last updated 2025-06-17 21:09:15

Assigner GitHub_M

State PUBLISHED

Description

Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.

← Browse all CVEs View on cve.org ↗