CVE-2024-47070: Authentication Bypass in authentik

The impact of CVE-2024-47070 is significant, as it enables unauthorized access to user accounts within the authentik identity provider. An attacker can bypass the standard password authentication process by injecting a specially crafted X-Forwarded-For header containing an invalid IP address (e.g., 'a'). This bypass is contingent on the authentik instance trusting the X-Forwarded-For header, which is typically only the case in environments behind a reverse proxy or load balancer. Successful exploitation could lead to data breaches, privilege escalation, and compromise of sensitive information managed by authentik.

1. Reserved2024-09-17
2. Published2024-09-27
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-47070 is to upgrade authentik to version 2024.8.3 or later, which contains the fix for this vulnerability. If immediate upgrading is not feasible, consider implementing stricter validation of the X-Forwarded-For header at the reverse proxy or load balancer level. This can involve whitelisting trusted IP addresses or rejecting requests with malformed or unexpected header values. Additionally, review your authentik configuration to ensure that the X-Forwarded-For header is not being trusted unnecessarily. After upgrading, confirm the fix by attempting a login with a crafted X-Forwarded-For header; the login should be rejected.