CVE-2022-23555

CVE-2022-23555 is an Improper Authentication vulnerability in authentik versions prior to 2022.11.4 and 2022.10.4, allowing token reuse in invitation URLs to bypass access control. This high-severity vulnerability (CVSS 8.8) enables an attacker to sign up for a different, potentially more privileged, enrollment flow than intended by leveraging a valid invitation token not bound to a specific flow. While the default configuration is not vulnerable, affected configurations include those using invitations with multiple enrollment flows that grant differing permissions. There is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed on the CISA KEV catalog, though it has received some community discussion.