CVE-2024-52289

CVE-2024-52289 is a critical vulnerability affecting authentik, an open-source identity provider, specifically within its OAuth2 redirect URI validation. The flaw arises from improper RegEx handling when no redirect URIs are configured or when special characters are not escaped, allowing attackers to bypass validation and register malicious domains. With a CVSS score of 9.8 (Critical), this vulnerability presents a severe risk, enabling unauthenticated attackers to achieve high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion, suggesting a low immediate threat of widespread attacks.