CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-53942

The Ghost in the Machine: Deactivated Users Haunt authentik's OAuth/SAML Flows

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 1, 2026·12 min read·80 visits

Executive Summary (TL;DR)

Deactivated users in authentik aren't really gone. A missing check allows them to continue authorizing applications via OAuth/SAML if they have the direct link. This turns account deactivation into security theater, allowing ex-employees or disabled accounts to waltz back in through the side door.

A critical privilege management flaw exists in authentik, a popular open-source Identity Provider. The vulnerability, CVE-2025-53942, stems from an insufficient check on the 'active' status of a user account during OAuth and SAML authentication flows. This oversight allows users who have been deactivated to retain access to downstream applications, effectively turning them into 'ghost' users who can bypass administrative controls and maintain a persistent foothold in the environment.

Technical Appendix

CVSS Score
7.4/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
EPSS Probability
0.07%
Top 100% most exploited

Affected Systems

authentik Identity Provider

Affected Versions Detail

Product
Affected Versions
Fixed Version
authentik
authentik Security
<= 2025.4.32025.4.4
authentik
authentik Security
>= 2025.6.0-rc1, < 2025.6.42025.6.4
AttributeDetail
CWE IDCWE-269
CWE NameImproper Privilege Management
Attack VectorNetwork
CVSS Score7.4 (High)
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
EPSS Score0.07% (Probability of exploitation is low)
ImpactUnauthorized Access, Information Disclosure, Privilege Persistence
Exploit StatusProof of Concept / Theoretical

MITRE ATT&CK Mapping

T1078Valid Accounts
Persistence
T1078.004Cloud Accounts
Initial Access
T1550Use Alternate Authentication Material
Defense Evasion
CWE-269
Improper Privilege Management

The software does not properly assign, check, track, or revoke privileges or permissions for an actor, creating an unintended sphere of control.

Vulnerability Timeline

Vulnerability discovered by an independent researcher.
2025-05-10
Vendor (authentik Security) privately notified.
2025-05-12
Patches developed and tested.
2025-06-20
Patched versions 2025.4.4 and 2025.6.4 released. Public disclosure and CVE published.
2025-06-25

References & Sources

  • [1]NVD - CVE-2025-53942
  • [2]MITRE - CWE-269: Improper Privilege Management

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 4 hours ago•CVE-2026-5326
5.3

CVE-2026-5326: Insecure Direct Object Reference (IDOR) in SourceCodester Leave Application System

An Insecure Direct Object Reference (IDOR) vulnerability exists in SourceCodester Leave Application System 1.0 within the User Information Handler component. The application processes client-supplied database identifiers via URL parameters without executing proper authorization checks or session validation. This allows remote, unauthenticated attackers to view sensitive administrative and employee records by altering the 'id' parameter.

Amit Schendel
Amit Schendel
5 views•5 min read
•3 days ago•GHSA-7PPR-R889-MCF2
7.5

GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.

Alon Barad
Alon Barad
7 views•5 min read
•3 days ago•GHSA-95CV-R8X4-VH75
7.6

GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler

A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.

Amit Schendel
Amit Schendel
10 views•7 min read
•3 days ago•GHSA-P6PH-3JX2-3337
4.3

GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList

OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.

Amit Schendel
Amit Schendel
8 views•5 min read
•3 days ago•GHSA-86CX-WWF4-PHQ4
6.5

GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.

Amit Schendel
Amit Schendel
8 views•6 min read
•3 days ago•CVE-2026-16584
7.0

CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure

A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.

Amit Schendel
Amit Schendel
12 views•7 min read