Is CVE-2023-39522 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-39522 being exploited in the wild.

How severe is CVE-2023-39522?

Medium severity, with a CVSS score of 5.3, published 29 August 2023.

Which products and versions are affected?

@goauthentik/api (npm) SEMVER:introduced=2023.6.0,fixed=2023.6.2.

Is there a fix for CVE-2023-39522?

Yes. @goauthentik/api (npm): upgrade to 2023.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-39522 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2023-39522?

Check whether you run @goauthentik/api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-39522: goauthentik username enumeration in recovery flow

CVE-2023-39522 · Severity: medium · CVSS 5.3 · Published 2023-08-29

goauthentik is an open-source identity provider used to manage user authentication and authorization. A vulnerability in the password recovery process allows unauthorized individuals to verify whether specific usernames or email addresses are registered on the system. This information can be used to facilitate targeted phishing attacks or credential stuffing attempts against your users.

Vendors: npm.

Quick answers

Is CVE-2023-39522 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-39522 being exploited in the wild.
How severe is CVE-2023-39522?: Medium severity, with a CVSS score of 5.3, published 29 August 2023.
Which products and versions are affected?: @goauthentik/api (npm) SEMVER:introduced=2023.6.0,fixed=2023.6.2.
Is there a fix for CVE-2023-39522?: Yes. @goauthentik/api (npm): upgrade to 2023.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-39522 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2023-39522?: Check whether you run @goauthentik/api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@goauthentik/api (npm): upgrade to 2023.6.2 or later
```
npm install @goauthentik/api@2023.6.2
```

Technical details

A username enumeration vulnerability exists in goauthentik's recovery flow due to an observable discrepancy (CWE-203) in how the system responds to valid versus invalid user identifiers. When an identification stage is used within a recovery flow, the application returns distinct messages or behaviors if a user does not exist, allowing a remote, unauthenticated attacker to brute-force or verify account existence via the network. This can be performed using usernames, email addresses, or both, depending on the specific flow configuration. The issue is resolved in versions 2023.5.6 and 2023.6.2 by ensuring the system returns uniform responses and always triggers the same background processes (like sending an email) regardless of whether the user exists.

Affected products

goauthentik authentik < 2023.5.6, >= 2023.6.0, < 2023.6.2

Identifiers

CVE-2023-39522
GHSA-vmf9-6pcv-xr87

Timeline

2023-08-29: disclosed
2023-08-29: advisory
2026-07-31: other: Advisory withdrawn due to incorrect package mapping, though the underlying vulnerability in authentik was previously valid.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.