{"schema_version":"1.7.3","id":"GHSA-9g4j-v8w5-7x42","published":"2025-07-22T14:31:12Z","modified":"2026-04-17T04:57:03.992073630Z","aliases":["BIT-authentik-2025-53942","CVE-2025-53942","GO-2025-3822"],"summary":"Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources","details":"### Summary\n\nDeactivated users that had either enrolled via OAuth/SAML or had their account connected to an OAuth/SAML account can still partially access authentik even if their account is deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application.\n\n### Patches\n\nauthentik 2025.4.4 and 2025.6.4 fix this issue.\n\n### Workarounds\n\nAdding an expression policy to the user login stage on the respective authentication flow with the expression of\n\n```py\nreturn request.context[\"pending_user\"].is_active\n```\n\nThis expression will only activate the user login stage when the user is active.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Email us at [security@goauthentik.io](mailto:security@goauthentik.io).","affected":[{"package":{"name":"goauthentik.io","ecosystem":"Go","purl":"pkg:golang/goauthentik.io"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250722122105-7a4c6b9b50f8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9g4j-v8w5-7x42/GHSA-9g4j-v8w5-7x42.json"}}],"references":[{"type":"WEB","url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-9g4j-v8w5-7x42"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53942"},{"type":"WEB","url":"https://github.com/goauthentik/authentik/commit/7a4c6b9b50f8b837133a7a1fd2cb9b7f18a145cd"},{"type":"WEB","url":"https://github.com/goauthentik/authentik/commit/c3629d12bfe3d32d3dc8f85c0ee1f087a55dde8f"},{"type":"WEB","url":"https://github.com/goauthentik/authentik/commit/ce3f9e3763c1778bf3a16b98c95d10f4091436ab"},{"type":"PACKAGE","url":"https://github.com/goauthentik/authentik"}],"database_specific":{"cwe_ids":["CWE-269"],"github_reviewed":true,"github_reviewed_at":"2025-07-22T14:31:12Z","nvd_published_at":"2025-07-23T21:15:26Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}