Medium · 4.8 CVE-2024-11623 EUVD-2024-34415GHSA-f8wx-qvvq-mwx4

Stored XSS in authentik

Published Feb 4, 2025 · Updated Feb 12, 2025 · Assigned by CERT-PL

Description

Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.
This action could only be performed by an authenticated admin user.
The issue was fixed in 2024.10.4 release.

Affected products

Vendor	Product	Affected	Fixed
goauthentik	authentik	< 2024.10.4	2024.10.4

References

https://docs.goauthentik.io/docs/security/audits-and-certs/2024-11-cobalt#svg-images-for-icons-possible-xss-vulnerability vendor-advisory
https://github.com/goauthentik/authentik/pull/12092 patch
https://cert.pl/en/posts/2025/02/CVE-2024-11623/ third-party-advisory