Listen to this Post
How the CVE Works
This vulnerability exists in the OAuth client credential flow. Authentik creates a dedicated service account for an external OAuth provider using a `client_id` and client_secret. The system correctly assigns permissions and enforces policies for this account. However, a flaw in the authentication logic fails to check the account’s active status. Even if an administrator deactivates this service account, the system continues to accept authentication requests using its credentials. The account’s permissions remain correctly scoped, but the core access control check bypasses the `is_active` flag, allowing a deactivated account to obtain tokens and interact with the system as long as its client credentials are valid.
Platform: Authentik
Version: <2025.8.5/2025.10.2
Vulnerability: Improper Access Control
Severity: Medium
date: 2025
Prediction: 2025-11-15
What Undercode Say:
`curl -u client_id:client_secret https://oauth-provider/token`
`if not request.user.is_active: deny_access()</h2>
<h2 style="color: blue;">ak.is_service_account_active(client_id)`
<h2 style="color: blue;">
How Exploit:
Use revoked client credentials.
Protection from this CVE
Update authentik versions.
Implement workaround policy.
Impact:
Bypassed account deactivation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
