CVE-2022-46145: authentik vulnerable to unauthorized user creation and potential account takeover
Vulnerability summary
CVE-2022-46145 is a critical (CVSS 9.8) Improper Authentication vulnerability in goauthentik authentik. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 69.5% of scored vulnerabilities.
Severe, CVSS 8.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 02-12-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.25%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Goauthentik1 product
- authentik≥ 2022.11.0, < 2022.11.2 | < 2022.10.2 | ≥ 2022.11, < 2022.11.2
1 vendor · 1 product
References
3 links- github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjfX Refsource CONFIRMMitigationThird Party Advisory