Read the docs
TI-2025-33807 Aliases CVE-2025-53942GHSA-9g4j-v8w5-7x42

authentik has an insufficient check for account active status during OAuth/SAML authentication

Priority LOW 32CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to OAuth/SAML providers can still retain partial access to the system despite their accounts being deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application. To workaround this issue, developers can add an expression policy to the user login stage on the respective authentication flow with the expression of return request.context["pending_user"].is_active. This modification ensures that the return statement only activates the user login stage when the user is active. This issue is fixed in versions authentik 2025.4.4 and 2025.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00579 47th percentileScored 2026-11-07
Fix Fixed authentik (goauthentik): 2025.6.4goauthentik.io (Go): 0.0.0-20250722122105-7a4c6b9b50f8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
goauthentikauthentik<= 2025.4.3, < 2025.4.4; 2025.6.0-rc1 to before 2025.6.42025.6.4Patch availableCNA
—goauthentik.io (Go)before 0.0.0-20250722122105-7a4c6b9b50f80.0.0-20250722122105-7a4c6b9b50f8Patch availableGHSA-9g4j-v8w5-7x42
  • authentik Vendorgoauthentik Affected <= 2025.4.3, < 2025.4.4; 2025.6.0-rc1 to before 2025.6.4 Fixed in 2025.6.4 Patch available CNA
  • goauthentik.io (Go) Vendor— Affected before 0.0.0-20250722122105-7a4c6b9b50f8 Fixed in 0.0.0-20250722122105-7a4c6b9b50f8 Patch available GHSA-9g4j-v8w5-7x42

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*before 2025.4.4; 2025.6.0 to before 2025.6.4Vulnerablegoauthentik
  • cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* Versions before 2025.4.4; 2025.6.0 to before 2025.6.4 Vulnerable ·goauthentik

Remediation

  • Fix · CNA authentik (goauthentik) Fixed in 2025.6.4
  • Fix · GHSA-9g4j-v8w5-7x42 goauthentik.io (Go) Fixed in 0.0.0-20250722122105-7a4c6b9b50f8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53942
  2. 2026-10-03 Alias added: GHSA-9g4j-v8w5-7x42

References

Patch 3

Advisory 2

Other 1

  • TI-2026-36603 authentik: SourceStage bypass via empty POST CVSS 3.1CRITICAL 9.8
  • TI-2022-07608 authentik vulnerable to Improper Authentication via invitation URL token reuse CVSS 3.1CRITICAL 9.4
  • TI-2026-36598 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API CVSS 3.1HIGH 8.8
  • TI-2022-22816 authentik allows existing authenticated users to create arbitrary accounts CVSS 3.1MEDIUM 6.4
  • TI-2024-25628 Insufficient access control for OAuth2 Device Code flow in authentik CVSS 3.1CRITICAL 9.8
  • TI-2023-24876 authentik potential installation takeover when default admin user is deleted CVSS 3.1CRITICAL 9.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences