Critical · published March 4, 2023
🚨 One poorly validated recovery link could let an attacker reset any user’s password! This vulnerability in authentik is both alarming and mind-blowingly simple to exploit. 🔥 Think of it like a restaurant where the chef accidentally leaves the secret recipe book in plain sight. If a rival chef gets their hands on it, they can easily recreate the restaurant's signature dishes — and in this case, steal user access entirely! With this vulnerability, an attacker can seize control of any user account by simply getting hold of a recovery link sent by an admin. This could lead to unauthorized access to sensitive information, putting countless users at risk and compromising the integrity of the system.
Think of it like a restaurant where the chef accidentally leaves the secret recipe book in plain sight. If a rival chef gets their hands on it, they can easily recreate the restaurant's signature dishes — and in this case, steal user access entirely! The flaw arises from an insufficient access check in the recovery flow, allowing any user with a legitimate recovery link to reset passwords for arbitrary accounts, bypassing necessary authentication checks.
With this vulnerability, an attacker can seize control of any user account by simply getting hold of a recovery link sent by an admin. This could lead to unauthorized access to sensitive information, putting countless users at risk and compromising the integrity of the system. To secure your systems, upgrade authentik to versions 2023.2.3, 2023.1.3, or 2022.12.2 immediately. Additionally, implement policy checks for custom recovery flows to ensure identification stages are enforced, even if the flow is restored. Don't delay! You've got this! By following these steps, you can lock down your authentik instance and protect your users from this threat. 🛡️