Executive brief
goauthentik is an open-source identity provider used to manage user authentication and authorization. A vulnerability in the password recovery process allows unauthorized individuals to verify whether specific usernames or email addresses are registered on the system. This information can be used to facilitate targeted phishing attacks or credential stuffing attempts against your users.
Technical details
A username enumeration vulnerability exists in goauthentik's recovery flow due to an observable discrepancy (CWE-203) in how the system responds to valid versus invalid user identifiers. When an identification stage is used within a recovery flow, the application returns distinct messages or behaviors if a user does not exist, allowing a remote, unauthenticated attacker to brute-force or verify account existence via the network. This can be performed using usernames, email addresses, or both, depending on the specific flow configuration. The issue is resolved in versions 2023.5.6 and 2023.6.2 by ensuring the system returns uniform responses and always triggers the same background processes (like sending an email) regardless of whether the user exists.
Affected products
- goauthentik authentik < 2023.5.6, >= 2023.6.0, < 2023.6.2
Timeline
- 2023-08-29: disclosed
- 2023-08-29: advisory
- 2026-07-31: other: Advisory withdrawn due to incorrect package mapping, though the underlying vulnerability in authentik was previously valid.