CVE-2025-53942: Goauthentik Auth Bypass Vulnerability

CVE-2025-53942 Overview

CVE-2025-53942 is an authentication bypass vulnerability affecting authentik, an open-source Identity Provider that emphasizes flexibility and versatility with support for a wide set of protocols. The vulnerability allows deactivated users who registered through OAuth/SAML or linked their accounts to OAuth/SAML providers to retain partial access to the system despite their accounts being deactivated. These users end up in a half-authenticated state where they cannot access the API but can still authorize applications if they know the application URL.

Critical Impact

Deactivated users can bypass authentication controls and authorize applications through OAuth/SAML, potentially maintaining unauthorized access to integrated services and compromising the integrity of identity management.

Affected Products

• goauthentik authentik versions 2025.4.4 and earlier
• goauthentik authentik versions 2025.6.0-rc1 through 2025.6.3

Discovery Timeline

• July 23, 2025 - CVE CVE-2025-53942 published to NVD
• August 21, 2025 - Last updated in NVD database

Technical Details for CVE-2025-53942

Vulnerability Analysis

This vulnerability stems from improper privilege management (CWE-269) in authentik's authentication flow handling for OAuth and SAML providers. When a user account is deactivated, the system fails to properly terminate or invalidate the authentication state for users who authenticated via federated identity providers. This creates a dangerous half-authenticated state where deactivated users retain the ability to authorize applications despite lacking API access.

The attack can be executed over the network without requiring any user interaction or prior authentication. While the vulnerability doesn't directly impact the primary system's confidentiality, integrity, or availability, it has significant downstream impact on connected systems, allowing unauthorized application authorization that could compromise integrated services.

Root Cause

The root cause lies in the user login stage implementation within authentik's authentication flow. When processing pending users during the login stage, the system logged a warning when encountering inactive users but did not properly terminate the authentication flow. This allowed the authentication process to continue, placing deactivated users in a partial authentication state where they could still authorize applications through direct URL access.

The fix addresses this by modifying authentik/stages/user_login/stage.py to return self.executor.stage_invalid() when an inactive user is detected, properly terminating the authentication flow. Additionally, the middleware was updated to import the Django logout function to properly handle session termination for deactivated users.

Attack Vector

An attacker who previously had a legitimate account that was deactivated (such as a terminated employee or suspended user) can exploit this vulnerability by:

1. Attempting to authenticate through an OAuth or SAML provider that was previously linked to their deactivated account
2. The authentication flow improperly allows them to enter a half-authenticated state
3. By directly navigating to known application authorization URLs, the attacker can authorize applications
4. This grants unauthorized access to downstream applications that trust authentik as their identity provider

# Vulnerable code in authentik/stages/user_login/stage.py
        user: User = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
        if not user.is_active:
            self.logger.warning("User is not active, login will not work.")
            # Missing: return self.executor.stage_invalid()
        delta = self.set_session_duration(remember)

Source: GitHub Security Patch

The patched version properly terminates the authentication flow:

# Fixed code in authentik/stages/user_login/stage.py
        user: User = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
        if not user.is_active:
            self.logger.warning("User is not active, login will not work.")
            return self.executor.stage_invalid()
        delta = self.set_session_duration(remember)

Source: GitHub Security Patch

Detection Methods for CVE-2025-53942

Indicators of Compromise

• Authentication log entries showing successful OAuth/SAML authentication attempts from deactivated user accounts
• Application authorization events associated with users whose is_active flag is set to false
• Warning log messages containing "User is not active, login will not work" followed by continued session activity
• Unusual application authorization patterns from users who should have lost access

Detection Strategies

• Monitor authentik logs for the warning message "User is not active, login will not work" which indicates an attempted bypass
• Implement alerting on application authorization events that correlate with deactivated user accounts in your user directory
• Review OAuth/SAML authentication logs for any successful authentications from accounts that were previously deactivated
• Cross-reference downstream application access logs with authentik's deactivated user list

Monitoring Recommendations

• Enable detailed logging for the user login stage and authentication flows in authentik
• Configure alerts for any authentication activity involving users with is_active=false
• Implement periodic audits of application authorizations against the current active user list
• Monitor for direct access attempts to application authorization URLs that bypass the standard authentication flow

How to Mitigate CVE-2025-53942

Immediate Actions Required

• Upgrade to authentik version 2025.4.5 or later for the 2025.4.x branch, or version 2025.6.4 or later for the 2025.6.x branch
• Review all application authorizations granted by users who have been deactivated since deploying affected versions
• Revoke any suspicious or unauthorized application authorizations discovered during the audit
• Force re-authentication for all active sessions to ensure deactivated users are properly logged out

Patch Information

The vulnerability is fixed in authentik versions 2025.4.5 and 2025.6.4. The security patches are available through the following commits:

• Commit 7a4c6b9b50f8b837133a7a1fd2cb9b7f18a145cd
• Commit c3629d12bfe3d32d3dc8f85c0ee1f087a55dde8f
• Commit ce3f9e3763c1778bf3a16b98c95d10f4091436ab

For complete details, see the GitHub Security Advisory GHSA-9g4j-v8w5-7x42.

Workarounds

• Add an expression policy to the user login stage on authentication flows that use OAuth/SAML with the expression: return request.context["pending_user"].is_active
• This policy modification ensures the user login stage only activates when the user is active
• Consider implementing additional access controls at the application level to verify user status before granting authorization

# Expression policy workaround for user login stage
# Add this expression to your authentication flow's user login stage
return request.context["pending_user"].is_active