CVE-2024-37905 Overview
CVE-2024-37905 is a privilege escalation vulnerability in authentik, an open-source Identity Provider (IdP). The flaw resides in the API-Access-Token mechanism, which an authenticated attacker can abuse to gain full administrator privileges. Successful exploitation grants the attacker administrative control of the authentik instance, including the ability to reset user passwords and reconfigure identity flows. Because authentik brokers authentication for downstream applications, compromise of the admin role can cascade into wider identity infrastructure exposure. The issue has been patched in authentik versions 2024.2.4, 2024.4.2, and 2024.6.0. The vulnerability is classified under [CWE-284: Improper Access Control].
Critical Impact
An authenticated low-privileged user can escalate to full administrator, reset arbitrary user passwords, and take over the identity provider.
Affected Products
- goauthentik authentik versions prior to 2024.2.4
- goauthentik authentik 2024.4.x prior to 2024.4.2
- goauthentik authentik versions prior to 2024.6.0
Discovery Timeline
- 2024-06-28 - CVE-2024-37905 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37905
Vulnerability Analysis
Authentik supports API-Access-Tokens that allow programmatic access to the platform's REST API. The vulnerability stems from improper access control (CWE-284) in how the API-Access-Token mechanism validates the association between a token and its intended user context. An attacker with a valid low-privileged authentik account can leverage the flawed token handling to perform API operations as an administrator. Once elevated, the attacker can call administrative endpoints to reset credentials, modify authentication flows, alter provider bindings, and issue new tokens. Because authentik commonly fronts single sign-on for SaaS and internal applications, admin takeover enables lateral movement into every application that trusts authentik as its IdP.
Root Cause
The root cause is missing or insufficient authorization checks within the API-Access-Token code path. The token mechanism does not correctly restrict privileged operations to accounts that legitimately hold the authentik Admins role, allowing effective role confusion between the authenticated principal and the target of the API call.
Attack Vector
Exploitation is network-based and requires an existing authenticated session or valid low-privileged credentials against the authentik API. No user interaction is required. The attacker crafts API requests that invoke the flawed token handling to obtain administrator-level authorization, then invokes the admin API surface (users, tokens, flows, providers) to complete the takeover.
No public proof-of-concept code has been published. For the vendor's technical description of the flaw and fixed versions, refer to the GitHub Security Advisory GHSA-c78c-2r9w-p7x4.
Detection Methods for CVE-2024-37905
Indicators of Compromise
- Unexpected creation, rotation, or use of entries in the authentik_api_token table or the Tokens administration view.
- Password reset events for privileged users that do not correlate with a helpdesk ticket or user-initiated flow.
- Admin group membership changes (authentik Admins) originating from API calls rather than the web UI.
- New OAuth2, SAML, or LDAP providers registered outside of change-management windows.
Detection Strategies
- Audit authentik's built-in Events log for model_created, model_updated, and password_set actions performed via API tokens rather than interactive sessions.
- Correlate authentik API access logs by source IP and user agent to identify tokens being used from unexpected locations.
- Alert on any privilege change where the actor is a non-admin user account or a service token.
Monitoring Recommendations
- Forward authentik application and audit logs to a centralized SIEM or data lake with retention sufficient to cover disclosure-to-patch windows.
- Baseline normal API-Access-Token usage per token identifier and alert on deviations in request volume or endpoint scope.
- Monitor downstream applications federated with authentik for anomalous SSO assertions that could indicate an attacker leveraging a hijacked admin role.
How to Mitigate CVE-2024-37905
Immediate Actions Required
- Upgrade authentik to 2024.2.4, 2024.4.2, or 2024.6.0 or later without delay.
- Rotate all existing API-Access-Tokens after upgrading, treating any pre-patch tokens as potentially exposed.
- Force a password reset and re-enrollment of MFA for any account in the authentik Admins group.
- Review authentik audit events dating back to when vulnerable versions were first deployed for signs of exploitation.
Patch Information
The maintainers fixed the API-Access-Token access control issue in the following releases: Authentik 2024.2.4, Authentik 2024.4.3, and Authentik 2024.6.0. Details are documented in GitHub Security Advisory GHSA-c78c-2r9w-p7x4.
Workarounds
- No official workaround exists; patching is the only supported remediation path.
- Restrict network exposure of the authentik API to trusted management networks until the upgrade is completed.
- Temporarily disable or delete unused API-Access-Tokens to reduce the attackable surface.
- Enforce strong MFA on all human accounts to raise the cost of obtaining the initial low-privileged foothold required for exploitation.
# Verify the running authentik version after upgrade
kubectl exec -n authentik deploy/authentik-server -- \
ak dump_config | grep -i version
# Or, for docker-compose deployments
docker compose exec server ak version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
