CVE-2024-52307: Goauthentik Authentik Auth Bypass Vulnerability

CVE-2024-52307 Overview

CVE-2024-52307 is a timing attack vulnerability in authentik, an open-source identity provider developed by goauthentik. The flaw exists in the /-/metrics/ endpoint, which uses a non-constant time comparison to validate the SECRET_KEY used for authentication. An unauthenticated network attacker can measure response time differences to brute-force the secret key one byte at a time. The endpoint exposes Prometheus metrics and is intended to be scraped internally by the Go proxy on port 9300, not accessed directly. Successful exploitation grants access to sensitive operational metrics from the authentik server. The issue is tracked under [CWE-208: Observable Timing Discrepancy].

Critical Impact
A successful timing attack recovers the authentik SECRET_KEY, allowing unauthenticated access to Prometheus metrics and undermining an authentication secret shared across the deployment.

Affected Products

goauthentik authentik versions prior to 2024.8.5
goauthentik authentik versions prior to 2024.10.3
Deployments exposing the /-/metrics/ endpoint through a public reverse proxy

Discovery Timeline

2024-11-21 - CVE-2024-52307 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52307

Vulnerability Analysis

The vulnerability is a classic side-channel timing attack. The /-/metrics/ endpoint in authentik authenticates requests by comparing a supplied token against the deployment SECRET_KEY. The pre-patch implementation used Python's default string equality operator, which short-circuits on the first mismatched byte. An attacker who can measure response latency across many requests can infer correct bytes progressively, reducing the search space from exponential to linear in the key length.

The endpoint returns Prometheus metrics that expose operational data about the authentik server. Because the SECRET_KEY is also used elsewhere in authentik for cryptographic operations, recovery has consequences beyond metrics exposure alone. The endpoint is designed for internal consumption by the Go proxy shipped in the authentik container, which re-exposes metrics on port 9300.

Root Cause

The root cause is the use of a non-constant time comparison function to validate the authentication token against the SECRET_KEY. Standard string comparison returns as soon as bytes diverge, leaking positional information through response timing. This maps to [CWE-208: Observable Timing Discrepancy].

Attack Vector

Exploitation requires network reachability to the /-/metrics/ endpoint. Attackers issue crafted requests with candidate tokens and measure server response time to determine how many leading bytes match the true secret. Repeated measurements filter out network jitter. The attack requires no authentication, no user interaction, and can be automated with standard HTTP tooling.

python

# Patch excerpt: authentik/root/monitoring.py
 """Metrics view"""

-from base64 import b64encode
+from hmac import compare_digest
+from pathlib import Path
+from tempfile import gettempdir

 from django.conf import settings
 from django.db import connections
# Source: https://github.com/goauthentik/authentik/commit/5ea4580884f99369f0ccfe484c04cb03a66e65b8

The Python fix replaces the vulnerable comparison with hmac.compare_digest, a constant-time comparison routine. A parallel change in internal/web/metrics.go introduces gorilla/securecookie and moves the shared secret to a file managed with os and path primitives.

Detection Methods for CVE-2024-52307

Indicators of Compromise

High-volume repetitive requests to the /-/metrics/ path from a single source, characteristic of timing measurement loops
Requests to /-/metrics/ reaching the authentik application container from outside the loopback or trusted scraper network
Successful 200 responses on /-/metrics/ originating from unexpected client IPs

Detection Strategies

Alert on any external access to /-/metrics/ at the reverse proxy or load balancer layer
Baseline the request rate to /-/metrics/ and flag statistical anomalies indicative of automated probing
Correlate large volumes of failed authentication attempts on the metrics endpoint with subsequent successful requests

Monitoring Recommendations

Enable access logging on the reverse proxy and forward logs to a centralized analytics platform for query and alerting
Track authentik version inventory to ensure deployments run 2024.8.5, 2024.10.3, or later
Monitor egress from authentik hosts for unexpected outbound connections that might indicate secret misuse post-exploitation

How to Mitigate CVE-2024-52307

Immediate Actions Required

Upgrade authentik to version 2024.8.5 or 2024.10.3, or any later release containing commit 5ea4580
Block external access to /-/metrics/ at the reverse proxy or load balancer in front of authentik
Rotate the authentik SECRET_KEY if the metrics endpoint has been publicly reachable

Patch Information

The fix is available in authentik 2024.8.5 and 2024.10.3. The Python code path now uses hmac.compare_digest for constant-time comparison, and the Go proxy authenticates using a secret stored on disk and validated with gorilla/securecookie. See the GitHub Security Advisory GHSA-2xrw-5f2x-m56j and the upstream commit for full details.

Workarounds

Configure the reverse proxy to deny all external requests to the /-/metrics/ path
Restrict Prometheus scraping to the dedicated port 9300 exposed by the Go proxy inside the container network
Enforce network-layer access control lists so only trusted monitoring subnets can reach authentik metrics ports

bash

# NGINX example: block external access to the metrics endpoint
location ~ ^/-/metrics/ {
    deny all;
    return 404;
}

# Scrape internally via the Go proxy port instead
# prometheus.yml
# - job_name: authentik
#   static_configs:
#     - targets: ['authentik-server:9300']