CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-53942

The Ghost in the Machine: Deactivated Users Haunt authentik's OAuth/SAML Flows

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 1, 2026·12 min read·90 visits

Executive Summary (TL;DR)

Deactivated users in authentik aren't really gone. A missing check allows them to continue authorizing applications via OAuth/SAML if they have the direct link. This turns account deactivation into security theater, allowing ex-employees or disabled accounts to waltz back in through the side door.

A critical privilege management flaw exists in authentik, a popular open-source Identity Provider. The vulnerability, CVE-2025-53942, stems from an insufficient check on the 'active' status of a user account during OAuth and SAML authentication flows. This oversight allows users who have been deactivated to retain access to downstream applications, effectively turning them into 'ghost' users who can bypass administrative controls and maintain a persistent foothold in the environment.

Technical Appendix

CVSS Score
7.4/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
EPSS Probability
0.07%
Top 100% most exploited

Affected Systems

authentik Identity Provider

Affected Versions Detail

Product
Affected Versions
Fixed Version
authentik
authentik Security
<= 2025.4.32025.4.4
authentik
authentik Security
>= 2025.6.0-rc1, < 2025.6.42025.6.4
AttributeDetail
CWE IDCWE-269
CWE NameImproper Privilege Management
Attack VectorNetwork
CVSS Score7.4 (High)
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
EPSS Score0.07% (Probability of exploitation is low)
ImpactUnauthorized Access, Information Disclosure, Privilege Persistence
Exploit StatusProof of Concept / Theoretical

MITRE ATT&CK Mapping

T1078Valid Accounts
Persistence
T1078.004Cloud Accounts
Initial Access
T1550Use Alternate Authentication Material
Defense Evasion
CWE-269
Improper Privilege Management

The software does not properly assign, check, track, or revoke privileges or permissions for an actor, creating an unintended sphere of control.

Vulnerability Timeline

Vulnerability discovered by an independent researcher.
2025-05-10
Vendor (authentik Security) privately notified.
2025-05-12
Patches developed and tested.
2025-06-20
Patched versions 2025.4.4 and 2025.6.4 released. Public disclosure and CVE published.
2025-06-25

References & Sources

  • [1]NVD - CVE-2025-53942
  • [2]MITRE - CWE-269: Improper Privilege Management

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•GHSA-JGH3-FGGC-MCPM
7.6

GHSA-jgh3-fggc-mcpm: Non-Blind Server-Side Request Forgery (SSRF) in Obot Platform

An authenticated Server-Side Request Forgery (SSRF) vulnerability in the Obot Platform allows administrative or power users to bypass IP verification and scan or query internal resources, private networks, and cloud instance metadata services (IMDS). Because response bodies and error details are reflected back to the client interface, this constitutes a non-blind SSRF.

Alon Barad
Alon Barad
5 views•8 min read
•about 2 hours ago•GHSA-JR78-W6W5-M8F8
7.3

GHSA-JR78-W6W5-M8F8: Missing Authorization in Semantic MediaWiki smwtask API Module Allows Unauthenticated Administrative Actions

Semantic MediaWiki starting from version 3.0.0 up to and including 7.2.1 is vulnerable to an unauthenticated missing authorization flaw in its `smwtask` API module. The endpoint fails to execute permission or privilege checks on callers. Instead, it relies on a CSRF token check, which can be satisfied by anonymous users using MediaWiki's static public CSRF token. Remote, unauthenticated attackers can exploit this flaw to retrieve internal database statistics, enqueue background jobs, run database queries, or trigger entity disposal processes, potentially leading to information disclosure, database corruption, and Denial of Service.

Alon Barad
Alon Barad
7 views•6 min read
•about 3 hours ago•CVE-2025-53837
9.9

CVE-2025-53837: Remote Code Execution in XWiki Rendering via Macro Escape Injection

CVE-2025-53837 is a critical remote code execution (RCE) vulnerability in XWiki Rendering before versions 14.10.2 and 15.0 RC1. The vulnerability arises from a failure to escape macro closing tags within raw output handled by HTML macro blocks. This allows low-privilege users to escape the restricted HTML container and execute high-privilege scripts under the application's context.

Alon Barad
Alon Barad
7 views•4 min read
•about 4 hours ago•CVE-2026-77281
6.5

CVE-2026-77281: Rewrite Placeholder Re-expansion Vulnerability in Caddy Web Server

A critical double-evaluation vulnerability exists in the rewrite module of the Caddy web server. Under specific configurations where a rewrite directive ends with a literal question mark and processes client-controlled headers, the system performs a secondary expansion pass. This allows attackers to evaluate arbitrary internal placeholder variables, leading to unauthorized disclosure of sensitive environment variables and system files.

Amit Schendel
Amit Schendel
6 views•8 min read
•about 5 hours ago•CVE-2026-77615
8.7

CVE-2026-77615: Stored Cross-Site Scripting (XSS) in Paella Player as used in Opencast

CVE-2026-77615 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in the Paella Player component, which is integrated as the default front-end media viewer in Opencast. Unsafe client-side rendering of subtitle tracks allows authenticated, low-privileged users to inject arbitrary JavaScript payloads via crafted WebVTT or DFXP files. The script executes within the context of any viewer session under the host origin, enabling session hijacking and unauthorized API interaction.

Alon Barad
Alon Barad
5 views•5 min read
•about 6 hours ago•GHSA-9395-2G46-RJ3F
8.2

GHSA-9395-2G46-RJ3F: Multiple Cross-Site Scripting (XSS) Vulnerabilities in djust Template and Live Engine

A comprehensive technical analysis of six Cross-Site Scripting (XSS) vulnerability classes in the djust framework versions 1.0.0 through 1.1.0, involving escaping failures across the Python-Rust template boundary and stateful WebSocket cache lifecycles.

Alon Barad
Alon Barad
5 views•10 min read