---
id: CVE-2023-3128
aliases:
  - GHSA-mpv3-g8m3-3fjc
  - BIT-grafana-2023-3128
  - GHSA-gxh2-6vvc-rrgp
title: Grafana vulnerable to Authentication Bypass by Spoofing
summary: Grafana vulnerable to Authentication Bypass by Spoofing
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'
vendor: grafana
product: github.com/grafana/grafana
ecosystem: go
affected:
  - 'github.com/grafana/grafana >= 9.4.0, < 9.4.13'
  - 'github.com/grafana/grafana >= 9.3.0, < 9.3.16'
  - 'github.com/grafana/grafana >= 9.0.0, < 9.2.20'
  - github.com/grafana/grafana < 8.5.27
patched:
  - github.com/grafana/grafana 9.4.13
  - github.com/grafana/grafana 9.3.16
  - github.com/grafana/grafana 9.2.20
  - github.com/grafana/grafana 8.5.27
published: '2023-06-22'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-mpv3-g8m3-3fjc'
references:
  - url: >-
      https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-3128'
  - url: 'https://github.com/grafana/grafana'
  - url: >-
      https://github.com/grafana/grafana/blob/69fc4e6bc0be2a82085ab3885c2262a4d49e97d8/CHANGELOG.md
  - url: 'https://grafana.com/security/security-advisories/cve-2023-3128'
  - url: 'https://security.netapp.com/advisory/ntap-20230714-0004'
tags:
  - osv
  - go
  - exploit-available
epss: 0.03995
epssPercentile: 0.90078
ingestedAt: '2026-07-09T18:56:36.643Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/spyata123/CVE-2023-3128'
  checkedAt: '2026-09-24T07:52:49.880Z'
exploitAvailable: true
---

## Overview

Grafana is validating Azure AD accounts based on the email claim. 

On Azure AD, the profile email field is not unique and can be easily modified. 

This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

## Affected packages

- `github.com/grafana/grafana >= 9.4.0, < 9.4.13`
- `github.com/grafana/grafana >= 9.3.0, < 9.3.16`
- `github.com/grafana/grafana >= 9.0.0, < 9.2.20`
- `github.com/grafana/grafana < 8.5.27`

## Remediation

Upgrade to a patched release:

- `github.com/grafana/grafana 9.4.13`
- `github.com/grafana/grafana 9.3.16`
- `github.com/grafana/grafana 9.2.20`
- `github.com/grafana/grafana 8.5.27`