PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows

Two security vulnerabilities, CVE-2023-48228 and CVE-2024-23647, were filed against the identity provider authentik, both describing a flaw in the handling of PKCE (Proof Key for Code Exchange). PKCE is a security mechanism defined in RFC 7636 that binds an authorization code to a secret known only to the client. The attackers exploit the fact that some servers accept PKCE in one request but not in the next, allowing them to downgrade the security to a pre-PKCE threat model.

This occurs when the server does not enforce the presence of both code_challenge and code_verifier parameters.

The first vulnerability, CVE-2023-48228, was present in authentik versions 2023.10.4 and 2023.8.5. The authentication endpoint only validated the presence of a code_verifier when it was provided, meaning an attacker could omit it during the token exchange phase. The second vulnerability, CVE-2024-23647, affected authentik versions 2023.10.6 and 2023.8.6. In this case, the authorization endpoint failed to reject requests missing the code_challenge parameter.

The impact of these vulnerabilities is significant, as they enable attackers to intercept and use authorization codes without proper verification. The attacker can conduct a man-in-the-middle (MITM) attack by modifying the authorization request to remove PKCE parameters, leading the server to issue an authorization code without the needed verifier binding. This code can then be exchanged for tokens at the token endpoint, allowing unauthorized access to protected resources.

The root cause of these vulnerabilities lies in the enforcement logic of the servers. According to RFC 9700, servers must support PKCE, enforce the correct code_verifier when a code_challenge is present, and reject token requests containing a code_verifier when no code_challenge was in the authorization request. Despite these requirements, most servers leave enforcement disabled by default, leaving them vulnerable to downgrade attacks.

In all four affected codebases, the issue stems from conditional enforcement based on parameter presence rather than being mandatory. The vulnerabilities have varying CVSS scores, ranging from 6.5 to 7.5, indicating the severity and potential impact of each vulnerability. To mitigate these risks, it is essential to ensure that servers adhere to the PKCE requirements outlined in RFC 9700, enforcing both code_challenge and code_verifier at appropriate stages of the authentication flow.