Unauthenticated account takeover via malformed forwarded IP

Authentication bypass in authentik before 2024.6.5 and 2024.8.0-rc1 through 2024.8.2 allows remote attackers to access known accounts. ClientIPMiddleware returned the first X-Forwarded-For value without validating it as an IP, so later policy evaluation raised an exception and failed open because the default password-stage binding lacked a true failure_result. Exploitation requires attacker-controlled X-Forwarded-For data to reach the service and a bound flow policy; the failed policy skips the password stage and grants access to an account whose login or email address is known.