CVE-2023-48228

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sign-on provider (authentik) must check if there is a matching and existing `code_verifier` during the token step. Prior to versions 2023.10.4 and 2023.8.5, authentik checks if the contents of `code_verifier` is matching only when it is provided. When it is left out completely, authentik simply accepts the token request with out it; even when the flow was started with a `code_challenge`. authentik 2023.8.5 and 2023.10.4 fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
goauthentikauthentik< 2023.10.4; < 2023.8.5

References

Timeline

Published
Nov 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482297.6Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write exists in the driver fCVE-2023-48235.4The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has CVE-2023-482309.8Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebCVE-2023-482314.3Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beCVE-2023-482324.3Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines andCVE-2023-482334.3Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abCVE-2023-482344.3Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. CVE-2023-482354.3Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically thiCVE-2023-482364.3Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. CVE-2023-482374.3Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large valCVE-2023-482387.5joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of repreCVE-2023-482397.1Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.1
CVE-2023-48228: Critical severity, CVSS 9.8 | Vulnix