Security readout for executives and security teams
Plain-English summary
authentik could trust user-supplied proxy IP headers in affected versions. That can make authentik and proxied applications record or act on a false client IP, weakening IP-based MFA exceptions, access policies, audit logs, blocking, and rate limiting.
Executive priority
Treat as high priority if authentik is internet-facing or IP address affects MFA, access decisions, or audit trails. Patch promptly, but urgency is lower for deployments not directly reachable by users and not using IP-based trust logic.
Technical view
Prior to 2023.4.3 and 2023.5.5, authentik did not verify the source of X-Forwarded-For and X-Real-IP headers in Python and Go code. Affected ranges are <2023.4.3 and >=2023.5.0, <2023.5.5. Exposure is limited to setups directly accessible by users without a reverse proxy.
Likely exposure
Most relevant for user-reachable authentik deployments without a reverse proxy, especially where custom flows, policies, sessions, logs, or downstream outpost-proxied applications trust client IP. Deployments not directly accessible to users are less likely in scope based on the advisory.
Exploitation context
The bundle does not show KEV listing or cited evidence of active exploitation. CVSS indicates network access, low complexity, no privileges, and no user interaction. Practical impact depends on whether IP headers influence trust decisions or audit evidence.
Researcher notes
The advisory names header source validation gaps across Python and Go components. Evidence supports spoofed logging/session IPs, custom IP policy bypass, and propagation to outpost-proxied applications. The source bundle does not provide exploit prevalence or additional affected products.
Mitigation direction
- Upgrade authentik to 2023.4.3, 2023.5.5, or a later fixed release.
- Review vendor release notes and advisory before scheduling remediation.
- Avoid direct user access to affected authentik instances where possible.
- Review custom flows and policies that use client IP address.
- Review downstream applications proxied through outposts for IP-based controls.
Validation and detection
- Inventory authentik versions and flag <2023.4.3 or >=2023.5.0, <2023.5.5.
- Confirm whether authentik is directly reachable by users without a reverse proxy.
- Identify custom flows or policies that depend on user IP address.
- Check whether outpost-proxied applications trust forwarded client IP headers.
- Review logs with caution because client IP fields may be unreliable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-436: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-36456 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L3.93.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.3HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/goauthentik/authentik/security/advisories/GHSA-cmxp-jcw7-jjjvCVE reference · x_refsource_CONFIRM
- https://github.com/goauthentik/authentik/commit/15026748d19d490eb2baf9a9566ead4f805f7dffCVE reference · x_refsource_MISC
- https://github.com/goauthentik/authentik/commit/c07a48a3eccbd7b23026f72136d3392bbc6f795aCVE reference · x_refsource_MISC
- https://goauthentik.io/docs/releases/2023.4#fixed-in-202343CVE reference · x_refsource_MISC
- https://goauthentik.io/docs/releases/2023.5#fixed-in-202355CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Interpretation Conflict
Interpretation Conflict represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.