UpHeron
All vulnerabilities

Servers and applications

CVE-2025-29928

Deletion of sessions did not revoke sessions when using database session storage

Severity
High 8.0
Published
28 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2024.12.4, 2025.2.3
Also known as
GHSA-p6p8-f853-9g2p
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • Every version before 2024.12.4
  • From 2025.2.0 before 2025.2.3
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2025.2.3
  • Every version before 2024.12.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-29928
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-29928
  • GitHub Advisory Database https://github.com/advisories/GHSA-p6p8-f853-9g2p
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-p6p8-f853-9g2p