Listen to this Post
This vulnerability occurs when Authentik fails to properly verify the active status of user accounts during OAuth/SAML authentication. Deactivated users who previously enrolled via OAuth/SAML or linked their accounts can bypass deactivation checks, entering a “half-authenticated” state. While API access remains restricted, attackers can still authorize applications if they know the target URLs. The flaw stems from missing validation in the OAuth/SAML authentication flow, allowing inactive users to retain partial system access.
DailyCVE Form:
Platform: Authentik
Version: < 2025.4.4, < 2025.6.4
Vulnerability: Insufficient account status check
Severity: High
Date: 2025-07-22
Prediction: Patch expected by 2025-07-30
What Undercode Say:
Check user active status in OAuth/SAML flow
if not user.is_active:
raise PermissionDenied("Account deactivated")
How Exploit:
1. Deactivate a user with OAuth/SAML enrollment.
2. Re-authenticate via OAuth/SAML.
3. Access application URLs directly.
Protection from this CVE:
1. Upgrade to Authentik 2025.4.4/2025.6.4.
2. Apply expression policy: `return user.is_active`.
Impact:
Partial unauthorized access, application authorization bypass.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
