authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header

The impact of CVE-2024-47070 is significant, as it enables unauthorized access to user accounts within the authentik identity provider. An attacker can bypass the standard password authentication process by injecting a specially crafted X-Forwarded-For header containing an invalid IP address (e.g., 'a'). This bypass is contingent on the authentik instance trusting the X-Forwarded-For header, which is typically only the case in environments behind a reverse proxy or load balancer. Successful exploitation could lead to data breaches, privilege escalation, and compromise of sensitive information managed by authentik.

Organizations utilizing authentik as an identity provider, particularly those deployed behind reverse proxies or load balancers, are at risk. Environments where the X-Forwarded-For header is trusted without proper validation are especially vulnerable. Shared hosting environments using authentik are also at increased risk due to potential header manipulation.

• linux / server:

journalctl -u authentik | grep -i "X-Forwarded-For"

• generic web:

curl -I <authentik_url> | grep X-Forwarded-For

• generic web: Inspect access logs for requests containing unusual or malformed X-Forwarded-For headers.

1. 2024-09-27Disclosure

   disclosure

1. Reserviert2024-09-17
2. Veröffentlicht2024-09-27
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-47070 is to upgrade authentik to version 2024.8.3 or later, which contains the fix for this vulnerability. If immediate upgrading is not feasible, consider implementing stricter validation of the X-Forwarded-For header at the reverse proxy or load balancer level. This can involve whitelisting trusted IP addresses or rejecting requests with malformed or unexpected header values. Additionally, review your authentik configuration to ensure that the X-Forwarded-For header is not being trusted unnecessarily. After upgrading, confirm the fix by attempting a login with a crafted X-Forwarded-For header; the login should be rejected.