CVE-2025-53942: OAuth/SAML Account Status Check in Authentik

The core impact of CVE-2025-53942 lies in the potential for unauthorized access to Authentik-managed resources. An attacker could exploit this flaw by crafting malicious OAuth or SAML requests that bypass the account active status verification. This could lead to the attacker impersonating a legitimate user and gaining access to sensitive data or performing actions on behalf of that user. The blast radius extends to any systems or applications relying on Authentik for authentication, as a compromised Authentik instance could serve as a gateway to other critical infrastructure. While no specific real-world exploitation has been publicly reported, the potential for abuse is significant, particularly in environments where OAuth/SAML integrations are prevalent.

1. Reserved2025-07-14
2. Published2025-08-11
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-53942 is to immediately upgrade Authentik to version v0.0.0-20250722122105-7a4c6b9b50f8 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting OAuth/SAML access to trusted sources or implementing stricter account activity monitoring. Review and audit all OAuth/SAML configurations to ensure they adhere to security best practices. After upgrading, confirm the fix by attempting to authenticate with a test user account via OAuth/SAML and verifying that the account active status is correctly enforced.