CVE-2024-52289 in authentik
Summary
by MITRE • 11/21/2024
authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirect_uri value received as an allowed redirect URI, without escaping characters that have a special meaning in RegEx. Similarly, the documentation did not take this into consideration either. Given a provider with the Redirect URIs set to https://foo.example.com, an attacker can register a domain fooaexample.com, and it will correctly pass validation. authentik 2024.8.5 and 2024.10.3 fix this issue. As a workaround, When configuring OAuth2 providers, make sure to escape any wildcard characters that are not intended to function as a wildcard, for example replace `.` with `\.`.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2025
The vulnerability identified as CVE-2024-52289 affects authentik, an open-source identity provider implementation that serves as a comprehensive solution for managing authentication and authorization across digital platforms. This security flaw resides within the OAuth2 provider component of authentik, specifically in how the system handles redirect URI validation through regular expression comparisons. The issue demonstrates a classic input validation weakness that can be exploited to bypass intended security controls, potentially allowing attackers to redirect users to malicious domains while maintaining the appearance of legitimate authentication flows.
The technical flaw manifests when authentik processes redirect URIs for OAuth2 providers without proper sanitization of special regex characters in the validation logic. When no redirect URIs are explicitly configured for a provider, the system automatically accepts the first redirect_uri value received and uses it as an allowed redirect URI without escaping characters that hold special meaning in regular expression syntax. This behavior creates a path for attackers to craft malicious redirect URIs that will pass validation checks despite not being legitimate. The vulnerability specifically exploits the lack of proper escaping for characters like dots, which in regex patterns match any character except newline, allowing attackers to construct domains that appear to match legitimate patterns while actually containing malicious variations.
The operational impact of this vulnerability is significant as it undermines the core security principle of redirect URI validation, which is designed to prevent open redirect attacks and phishing attempts. An attacker who successfully exploits this vulnerability could redirect users from a legitimate authentication flow to a malicious domain, potentially capturing credentials or performing other malicious actions. The vulnerability affects authentik versions 2024.8.5 and 2024.10.3, with the fixes addressing the root cause through proper regex escaping mechanisms. This issue aligns with CWE-185, which covers improper regular expression handling, and represents a direct violation of the principle of least privilege in authentication flows.
The fix implemented in authentik 2024.8.5 and 2024.10.3 addresses the vulnerability through proper input sanitization of redirect URI values before they are used in regex comparisons. The recommended workaround involves manual escaping of wildcard characters in redirect URI configurations, specifically replacing literal dots with escaped sequences like \. to prevent regex interpretation. This approach aligns with ATT&CK technique T1566.002, which covers phishing through social engineering, as the vulnerability could enable attackers to create convincing but malicious authentication redirection scenarios. Organizations using authentik should immediately implement the workaround or upgrade to the patched versions to prevent potential exploitation, as the vulnerability could be leveraged in targeted attacks against authentication systems that rely on redirect URI validation for security purposes. The remediation process requires careful attention to existing redirect URI configurations to ensure that legitimate domains continue to function properly while preventing the exploitation vector that the vulnerability presents.