« Volver al listado

CVE-2022-46172

Estado: ModificadaMedia (6.4)—

authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default.

Leer descripción completaMostrar menos

However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Goauthentik — Authentik

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-46172",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-46172",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-11T15:46:29.663612Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "goauthentik",
          "product": "authentik",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2022.11.0, < 2022.11.4"
            },
            {
              "status": "affected",
              "version": ">= 2022.10.0, < 2022.10.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-28T07:15:07.833",
  "references": [
    {
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4."
    },
    {
      "lang": "es",
      "value": "authentik es un proveedor de identidad de código abierto centrado en la flexibilidad y la versatilidad. En versiones anteriores a 2022.10.4 y 2022.11.4, cualquier usuario autenticado puede crear una cantidad arbitraria de cuentas a través de los flujos predeterminados. Esto omitiría cualquier política en una situación en la que no sea deseable que los usuarios creen nuevas cuentas por sí mismos. Esto también puede afectar a otras aplicaciones, ya que estas nuevas cuentas básicas existirían en toda la infraestructura de SSO. De forma predeterminada, no se puede iniciar sesión en las cuentas recién creadas ya que no existe ningún restablecimiento de contraseña. Sin embargo, es probable que la mayoría de las instalaciones habiliten el restablecimiento de contraseñas. Esta vulnerabilidad pertenece al contexto de usuario utilizado en el flujo de configuración de usuario predeterminado, /api/v3/flows/instances/default-user-settings-flow/execute/. Este problema se solucionó en las versiones 2022.10.4 y 2022.11.4."
    }
  ],
  "lastModified": "2026-06-17T05:11:21.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99BE347E-A6BA-42EA-98CE-AFAE2F5D4A37",
              "versionEndExcluding": "2022.10.4",
              "versionStartIncluding": "2022.10.0"
            },
            {
              "criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F1325E1-8B8D-4E34-A443-646C43280671",
              "versionEndExcluding": "2022.11.4",
              "versionStartIncluding": "2022.11.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}