goauthentik prior 2024.12.4/2025.2.3 Web Interface/API session fixiation

Summaryinfo

A vulnerability was found in goauthentik authentik and classified as critical. The affected element is an unknown function of the component Web Interface/API. The manipulation results in session fixiation. This vulnerability is identified as CVE-2025-29928. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in goauthentik authentik. It has been classified as critical. Affected is an unknown code of the component Web Interface/API. The manipulation with an unknown input leads to a session fixiation vulnerability. CWE is classifying the issue as CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-29928 since 03/12/2025. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 2024.12.4 or 2025.2.3 eliminates this vulnerability. Applying the patch 71294b7deb6eb5726a782de83b957eaf25fc4cf6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• goauthentik

Name

• authentik

License

• open-source

Website

• Product: https://github.com/goauthentik/authentik/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion