Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
authentik performs insufficient validation of OAuth scopes
Vulnerability Description
authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.
CVSS Information
N/A
Vulnerability Type
授权机制不恰当
Vulnerability Title
authentik 授权问题漏洞
Vulnerability Description
authentik是authentik开源的一个开源身份提供应用程序。 authentik存在授权问题漏洞，该漏洞源于当使用client_credentials或device_codeOAuth授权时，导致攻击者会从Authentik获取一个令牌。
CVSS Information
N/A
Vulnerability Type
N/A