Is CVE-2023-46249 actively exploited?

No active exploitation of CVE-2023-46249 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-46249 be exploited remotely?

Yes. CVE-2023-46249 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-46249?

CVE-2023-46249 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2023-46249

CRITICAL

CVE-2023-46249

CWE-287Published: October 31, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again. authentik 2023.8.4 and 2023.10.2 fix this issue. As a workaround, ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.

NVD Source

Risk Analysis

A critical vulnerability in authentik allows an unauthenticated attacker to reset the password of the default admin user if that user has been deleted. This bypasses authentication controls and grants full administrative access, warranting a 9.8 CVSS score.

No public exploit is known, and it is not in the KEV database. The flaw is remotely exploitable.

Recommended Action

Upgrade to authentik versions 2023.8.4 or 2023.10.2. As a workaround, ensure the default admin user exists and is protected by a strong password.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-46249 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.