CVE-2025-52553: Authentik Auth Bypass Vulnerability

CVE-2025-52553 Overview

CVE-2025-52553 is an authentication bypass vulnerability in authentik, an open-source identity provider. The vulnerability exists in the Remote Access Connection (RAC) feature where connection tokens are not properly validated against the user's session. After authorizing access to a RAC endpoint, authentik creates a token intended for a single connection that is sent to the client in the URL. This token should only be valid for the session of the user who authorized the connection, however this critical session validation check is missing in vulnerable versions.

Critical Impact

A malicious user could hijack authenticated RAC sessions by copying the connection URL, such as during a screenshare, gaining unauthorized access to remote systems without proper authentication.

Affected Products

• goauthentik authentik versions prior to 2025.6.3
• goauthentik authentik versions prior to 2025.4.3

Discovery Timeline

• 2025-06-27 - CVE-2025-52553 published to NVD
• 2025-08-21 - Last updated in NVD database

Technical Details for CVE-2025-52553

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication). The core issue lies in the token validation logic within authentik's RAC provider module. When a user authorizes a RAC connection, the system generates a ConnectionToken that is passed via the URL. In vulnerable versions, the filter_not_expired() function only validates the token itself without verifying that the requesting session matches the session that originally created the token.

This missing session binding allows any user who obtains the token URL—through screen sharing, network interception, or other means—to establish their own connection to the RAC endpoint. The attacker does not need to authenticate or have any prior authorization; they simply need the URL containing the token.

Root Cause

The root cause is the absence of session key validation in the ConnectionToken.filter_not_expired() query. The vulnerable code only filtered tokens by their value and expiration status, without binding the token to the originating user's session. This architectural oversight meant that tokens were effectively bearer tokens rather than session-bound credentials.

Attack Vector

The attack requires network access to the authentik instance and user interaction—specifically, the attacker must obtain the RAC connection URL from a legitimate user. Common attack scenarios include:

1. Screen sharing exposure: During a video call or screen share, the attacker observes and copies the URL from the victim's browser
2. URL leakage: The token URL could be inadvertently shared through browser history sync, messaging applications, or clipboard managers
3. Network interception: On shared networks, an attacker could capture the URL if transmitted over unencrypted channels

Once the URL is obtained, the attacker can navigate to it in their own browser and establish a connection to the RAC endpoint, effectively hijacking the remote access session.

# Vulnerable code - token lookup without session validation
def init_outpost_connection(self):
    """Initialize guac connection settings"""
    self.token = (
        ConnectionToken.filter_not_expired(token=self.scope["url_route"]["kwargs"]["token"])
        .select_related("endpoint", "provider", "session", "session__user")
        .first()
    )

Source: GitHub Commit 0e07414

The fix adds session key validation to bind the token to the original user's session:

# Patched code - token lookup WITH session validation
def init_outpost_connection(self):
    """Initialize guac connection settings"""
    self.token = (
        ConnectionToken.filter_not_expired(
            token=self.scope["url_route"]["kwargs"]["token"],
            session__session__session_key=self.scope["session"].session_key,
        )
        .select_related("endpoint", "provider", "session", "session__user")
        .first()
    )

Source: GitHub Commit 0e07414

Detection Methods for CVE-2025-52553

Indicators of Compromise

• Multiple RAC connections using the same token from different session keys or IP addresses
• RAC connection attempts where the session key does not match the original authorization session
• Unusual patterns of RAC token usage shortly after screen sharing sessions or video conferences
• Connection logs showing token reuse across different authenticated user sessions

Detection Strategies

• Monitor authentik logs for RAC connection events and correlate token usage with originating session identifiers
• Implement alerting on RAC connections that occur from IP addresses different from the original authorization
• Review access logs for patterns indicating token sharing or reuse across multiple browser sessions
• Deploy network monitoring to detect RAC URL patterns being transmitted to unauthorized destinations

Monitoring Recommendations

• Enable verbose logging for the RAC provider module to capture session and token details
• Configure SIEM rules to alert on anomalous RAC connection patterns
• Implement session analytics to identify potential token hijacking attempts
• Monitor for rapid successive RAC connections using identical tokens from different network sources

How to Mitigate CVE-2025-52553

Immediate Actions Required

• Upgrade authentik to version 2025.6.3 or 2025.4.3 immediately
• Review RAC connection logs for any suspicious activity indicating potential exploitation
• Audit active RAC sessions and terminate any that appear unauthorized
• Notify users to avoid screen sharing while RAC connections are active until the patch is applied

Patch Information

The vulnerability has been addressed in authentik versions 2025.4.3 and 2025.6.3. The fix adds session key validation to the ConnectionToken.filter_not_expired() function in both consumer_client.py and views.py. Security patches are available through the following commits:

• Commit 0e07414e9739b318cff9401a413a5fe849545325
• Commit 65373ab21711d58147b5cb9276c5b5876baaa5eb
• Commit 7100d3c6741853f1cfe3ea2073ba01823ab55caa

For complete details, refer to the GitHub Security Advisory GHSA-wr3v-9p2c-chx7.

Workarounds

• Decrease the token validity duration in RAC Provider settings by setting Connection expiry to minutes=5 or less
• Enable the "Delete authorization on disconnect" option in the RAC Provider configuration
• Restrict RAC access to trusted networks only using network-level access controls
• Educate users to avoid initiating RAC connections during screen sharing sessions

# Configuration example - RAC Provider settings
# In authentik admin interface, navigate to:
# Providers -> RAC Provider -> Edit
# Set the following:
# Connection expiry: minutes=5
# Delete authorization on disconnect: Enabled