Executive brief
Authentik vulnerable to PKCE downgrade attack in goauthentik.io
Affected products
- Go goauthentik.io
Junglewise Threat Intelligence
CVE-2024-23647: GO-2024-2479 - Authentik vulnerable to PKCE downgrade attack in goauthentik.io
CVE-2024-23647 · Severity: low · CVSS 3.1 · Published 2024-06-28
Technologies: goauthentik.io (Go). Vendors: Go.
Related threats
- goauthentik authentik XML Signature Wrapping in SAML Source ACS
- GO-2025-4137 - authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io
- GO-2025-4136 - authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io
- GO-2025-3822 - Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources in goauthentik.io
- GO-2024-3085 - GoAuthentik vulnerable to Insufficient Authorization for several API endpoints in goauthentik.io