CVE-2024-38371: Goauthentik Auth Bypass Vulnerability

CVE-2024-38371 Overview

CVE-2024-38371 is an authorization bypass vulnerability in authentik, an open-source Identity Provider. The vulnerability exists in the OAuth2 Device code flow implementation, where access restrictions assigned to an application are not properly checked. This flaw could potentially allow users without the correct authorization to obtain OAuth tokens for an application and gain unauthorized access to protected resources.

Critical Impact

Unauthorized users can bypass application access restrictions and obtain valid OAuth tokens, potentially compromising application security and user data across the identity provider infrastructure.

Affected Products

• goauthentik authentik versions prior to 2024.6.0
• goauthentik authentik versions prior to 2024.4.3
• goauthentik authentik versions prior to 2024.2.4

Discovery Timeline

• June 28, 2024 - CVE CVE-2024-38371 published to NVD
• August 21, 2025 - Last updated in NVD database

Technical Details for CVE-2024-38371

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), representing a fundamental failure in the authorization verification process within authentik's OAuth2 Device code flow implementation. The OAuth2 Device Authorization Grant flow is typically used by devices with limited input capabilities (such as smart TVs or IoT devices) to obtain access tokens. During this flow, the user authenticates through a separate browser session while the device polls for the resulting token.

The critical flaw lies in the fact that authentik failed to verify whether the authenticating user actually had the proper permissions to access the target application before issuing OAuth tokens. This means that even if administrators had configured specific access restrictions on an application (such as group membership requirements or policy-based access controls), these restrictions were not enforced during the device code flow.

An attacker could exploit this vulnerability to gain access to applications they should not have permission to use, potentially leading to unauthorized data access, privilege escalation within connected systems, or lateral movement across the organization's OAuth-protected resources.

Root Cause

The root cause of CVE-2024-38371 is improper access control validation in the OAuth2 Device code flow. When processing device code authorization requests, the authentik application failed to evaluate the application-specific access restrictions that were configured by administrators. The authorization logic that normally enforces user-to-application access policies was not applied to this particular authentication flow, creating a gap in the security model.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker with valid credentials to the authentik instance could initiate an OAuth2 Device code flow targeting any application configured within the identity provider, regardless of whether they have explicit access permissions to that application.

The attack flow would involve:

1. Initiating a device code flow request targeting a restricted application
2. Completing the authentication process with valid user credentials
3. Receiving OAuth tokens for the target application despite lacking proper authorization
4. Using the obtained tokens to access the protected application resources

The vulnerability is particularly concerning because it undermines the entire access control model that organizations rely on to segment application access based on user roles, groups, or policies.

Detection Methods for CVE-2024-38371

Indicators of Compromise

• Unexpected OAuth token grants for applications where the user should not have access based on configured policies
• Device code flow authentication events from users not authorized for specific applications
• Anomalous access patterns showing users accessing applications outside their normal permission scope
• Log entries indicating successful device code flow completions followed by application access that bypasses normal authorization checks

Detection Strategies

• Review authentik audit logs for device code flow authentication events and correlate with application access permissions
• Monitor for OAuth token issuance patterns where the requesting user lacks application-level permissions
• Implement alerting on successful device code flow completions for sensitive applications with restricted access
• Compare authorized user lists for applications against actual token grants through the device code flow

Monitoring Recommendations

• Enable comprehensive logging for all OAuth2 flows within authentik, particularly the device code flow
• Set up monitoring dashboards to track authentication flow types and correlate with expected user-application mappings
• Implement real-time alerting for access to high-value applications through device code flows
• Regularly audit OAuth token grants against configured access policies to identify potential exploitation

How to Mitigate CVE-2024-38371

Immediate Actions Required

• Upgrade authentik to patched versions 2024.6.0, 2024.4.3, or 2024.2.4 immediately
• Audit recent device code flow authentications to identify any potential unauthorized access
• Review OAuth tokens issued through device code flows for applications with access restrictions
• Consider revoking and re-issuing tokens for sensitive applications that may have been compromised

Patch Information

The goauthentik team has released security patches addressing this vulnerability. Organizations should upgrade to one of the following patched versions based on their current deployment:

• Version 2024.6.0 - Latest release with the fix
• Version 2024.4.3 - Patch for 2024.4.x branch
• Version 2024.2.4 - Patch for 2024.2.x branch

For complete details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-jq3m-37m7-gp45.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the OAuth2 Device code flow for sensitive applications until the upgrade can be completed
• Implement additional network-level access controls to limit who can initiate device code flows
• Enable enhanced monitoring and alerting on all device code flow authentications as an interim measure
• Review and restrict which applications support the device code flow to only those that absolutely require it

# Verify authentik version after upgrade
docker exec -it authentik-server ak version
# Or for Kubernetes deployments
kubectl exec -it deployment/authentik-server -- ak version
# Expected output should show 2024.6.0, 2024.4.3, or 2024.2.4 or later