CVE-2023-39522: 
JavaScript vulnerability analysis and mitigation

CVE-2023-39522 affects goauthentik, an open-source Identity Provider, in versions up to 2023.5.5 and 2023.6.1. The vulnerability was discovered and reported by markrassamni, and was disclosed on August 29, 2023. The issue allows attackers to enumerate and verify the existence of user accounts through the recovery flow functionality (GitHub Advisory).

The vulnerability is classified as a username enumeration attack with a CVSS v3.1 base score of 5.3 (Medium). The attack vector is Network (N), with Low attack complexity (L), requiring No privileges (N) and No user interaction (UI). The vulnerability occurs when using a recovery flow with an identification stage, where the system provides different messages for existing versus non-existing users (GitHub Advisory).

The vulnerability affects systems configured with a recovery flow, allowing attackers to determine whether specific usernames or email addresses exist in the system. This information disclosure can be exploited through either username, email, or both, depending on the system configuration (GitHub Advisory).

The vulnerability has been patched in versions 2023.5.6 and 2023.6.2. Users are advised to upgrade to these or later versions. No workarounds are available for this vulnerability (NVD).