{"id":"BIT-authentik-2024-21637","summary":"XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode","details":"Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.","aliases":["CVE-2024-21637","GHSA-rjpr-7w8c-gv3j"],"modified":"2026-09-10T16:01:09.295932968Z","published":"2026-04-16T23:36:10.878Z","database_specific":{"cpes":["cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*"],"severity":"High"},"references":[{"type":"FIX","url":"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.6"},{"type":"FIX","url":"https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.6"},{"type":"ADVISORY","url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-rjpr-7w8c-gv3j"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21637"}],"affected":[{"package":{"name":"authentik","ecosystem":"Bitnami","purl":"pkg:bitnami/authentik"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2023.8.0"},{"fixed":"2023.8.6"},{"introduced":"2023.10.0"},{"fixed":"2023.10.6"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/authentik/BIT-authentik-2024-21637.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}]}],"schema_version":"1.9.0"}