| Package | Affected versions | Patched versions |
|---|---|---|
| authentik | ≥ 2024.10.0, < 2024.10.3< 2024.8.5 | 2024.10.32024.8.5 |
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free