Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Admins can reset any user's password via email link
BIT-authentik-2023-26481
CVE-2023-26481
GHSA-3xf5-pqvf-rqq3
Summary
If an attacker gets a password reset link from an admin, they can set any password for any user's account. To fix this, update to version 2023.2.3, 2023.1.3, or 2022.12.2 of authentik. Alternatively, add a policy to custom recovery flows to skip the identification stage when the flow is restored.
What to do
- Update authentik to version 2022.12.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | authentik |
>= 2023.2.0, <= 2023.2.3 Fix: upgrade to 2022.12.3
|
Original title
Insufficient user check in FlowTokens by Email stage
Original description
authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2.
Published: 16 Apr 2026 · Updated: 17 Apr 2026 · First seen: 17 Apr 2026