Authentik は、goauthentik.io で OAuth/SAML ソースで認証する際に、アカウントのアクティブ状態のチェックが不十分です。

The core impact of CVE-2025-53942 lies in the potential for unauthorized access to Authentik-managed resources. An attacker could exploit this flaw by crafting malicious OAuth or SAML requests that bypass the account active status verification. This could lead to the attacker impersonating a legitimate user and gaining access to sensitive data or performing actions on behalf of that user. The blast radius extends to any systems or applications relying on Authentik for authentication, as a compromised Authentik instance could serve as a gateway to other critical infrastructure. While no specific real-world exploitation has been publicly reported, the potential for abuse is significant, particularly in environments where OAuth/SAML integrations are prevalent.

Organizations heavily reliant on Authentik for centralized authentication, particularly those using OAuth or SAML integrations with third-party applications, are at significant risk. Environments with legacy OAuth/SAML configurations or those lacking robust account activity monitoring are especially vulnerable.

• linux / server: Monitor Authentik logs for unusual authentication attempts or errors related to OAuth/SAML. Use journalctl -u authentik to filter for relevant events.

journalctl -u authentik | grep -i "oauth" | grep -i "saml" | grep -i "error"

• generic web: Check Authentik's OAuth/SAML endpoints for unexpected behavior or unauthorized access attempts using curl -v <oauthendpoint> and curl -v <samlendpoint>. Examine access and error logs for suspicious patterns.

1. 2025-08-11Disclosure

   disclosure

1. 予約済み2025-07-14
2. 公開日2025-08-11
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-53942 is to immediately upgrade Authentik to version v0.0.0-20250722122105-7a4c6b9b50f8 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting OAuth/SAML access to trusted sources or implementing stricter account activity monitoring. Review and audit all OAuth/SAML configurations to ensure they adhere to security best practices. After upgrading, confirm the fix by attempting to authenticate with a test user account via OAuth/SAML and verifying that the account active status is correctly enforced.