CVE-2025-53942

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to OAuth/SAML providers can still retain partial access to the system despite their accounts being deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application. To workaround this issue, developers can add an expression policy to the user login stage on the respective authentication flow with the expression of return request.context["pending_user"].is_active. This modification ensures that the return statement only activates the user login stage when the user is active. This issue is fixed in versions authentik 2025.4.4 and 2025.6.4.

• CWE-269

• https://github.com/goauthentik/authentik/commit/7a4c6b9b50f8b837133a7a1fd2cb9b7f18a145cdPatch
• https://github.com/goauthentik/authentik/commit/c3629d12bfe3d32d3dc8f85c0ee1f087a55dde8fPatch
• https://github.com/goauthentik/authentik/commit/ce3f9e3763c1778bf3a16b98c95d10f4091436abPatch
• https://github.com/goauthentik/authentik/security/advisories/GHSA-9g4j-v8w5-7x42Vendor Advisory

Published

Jul 23, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53937WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-53938WeGIA is an open source web manager with a focus on the Port…7.5
• CVE-2025-53939Kiteworks is a private data network (PDN). Prior to version …8.8
• CVE-2025-5394The Alone – Charity Multipurpose Non-profit WordPress Theme …9.8
• CVE-2025-53940Quiet is an alternative to team chat apps like Slack, Discor…8.5
• CVE-2025-53941Hollo is a federated single-user microblogging software desi…6.1
• CVE-2025-53943VoidBot Open-Source is a customizable Discord bot. VoidBot O…8.7
• CVE-2025-53944AutoGPT is a platform that allows users to create, deploy, a…7.7
• CVE-2025-53945apko allows users to build and publish OCI container images …7
• CVE-2025-53946WeGIA is an open source web manager with a focus on the Port…8.8
• CVE-2025-53947A local attacker with low privileges on the Windows system w…7.7
• CVE-2025-53948The Sante PACS Server allows a remote attacker to crash the …8.7