UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53942

Insufficient check for account active status when authenticating with OAuth/SAML Sources

Severity
High 7.1
Published
22 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2025.4.4, 2025.6.4
Also known as
GHSA-9g4j-v8w5-7x42
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to OAuth/SAML providers can still retain partial access to the system despite their accounts being…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • Every version before 2025.4.4
  • From 2025.6.0 before 2025.6.4
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2025.6.4
  • Every version before 2025.4.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53942
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53942
  • GitHub Advisory Database https://github.com/advisories/GHSA-9g4j-v8w5-7x42
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-9g4j-v8w5-7x42