CVE-2023-27891: OAuth Application Authorization Bypass in pretix
Summary
CVE-2023-27891: rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1. Affects pretix versions < 4.17.1. Fixed in 4.17.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pretix is a Python package available on PyPI that provides event ticketing and registration functionality. It allows users to create and manage events, sell tickets, and handle attendee registrations. This vulnerability affects pretix versions prior to 4.17.1.
Vulnerability Detail
The vulnerability in pretix before version 4.17.1 allows OAuth application authorization from a logged-out session. This means that an attacker can bypass the authentication process and gain unauthorized access to the application. The impact of this vulnerability could include unauthorized access to event data, ticket sales, attendee information, and potentially other sensitive data stored within the application.
How To Fix
Latest published version: 2026.8.0 as of 22 Oct 2026
pip install --upgrade "pretix==2026.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.17.1
This is the first release that contains the fix.
pip install --upgrade "pretix==4.17.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, pretix versions prior to 4.17.1 are vulnerable to an OAuth application authorization bypass. It is crucial to update to version 4.17.1 or later to mitigate this vulnerability and protect the application and its data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pretix →
FAQ
You can check the version of pretix installed by running the command 'pretix --version' in your terminal.
No, the recommended solution is to update pretix to the fixed version 4.17.1 or later.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, this vulnerability can be exploited remotely by an attacker without requiring any prior authentication.
There is no evidence of active exploitation of this vulnerability at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for pretix.
