PT-2025-12554 · Authentik · Authentik

Published 2025-03-23 · Updated 2026-04-16 · CVE-2025-29928

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.12.4 authentik versions prior to 2025.2.3

Description The issue arises when authentik is configured to use the database for session storage, a non-default setting. In this configuration, deleting sessions via the Web Interface or the API does not revoke the session, allowing the session holder to continue accessing authentik.

Recommendations For versions prior to 2024.12.4 and 2025.2.3, switch to cache-based session storage until an upgrade to a fixed version is possible, noting that this will delete all existing sessions and require users to re-authenticate. Upgrade to version 2024.12.4 or 2025.2.3 to fix the issue.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BIT-AUTHENTIK-2025-29928

CVE-2025-29928

GHSA-P6P8-F853-9G2P

Affected Products

Authentik

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29928.json · Exploit
• https://github.com/goauthentik/authentik/commit/71294b7deb6eb5726a782de83b957eaf25fc4cf6 · Patch
• https://github.com/goauthentik/authentik/security/advisories/GHSA-p6p8-f853-9g2p · Vendor Advisory
• https://osv.dev/vulnerability/BIT-authentik-2025-29928 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29928 · Security Note
• https://twitter.com/VulmonFeeds/status/1905771836018950229 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1905660537238667280 · Twitter Post
• https://t.me/cvetracker/20198 · Telegram Post
• https://twitter.com/chicago_sport_p/status/1903934135300771852 · Twitter Post
• https://twitter.com/CVEnew/status/1905674330723549343 · Twitter Post
• https://t.me/cveNotify/133067 · Telegram Post
• https://t.me/cvedetector/21438 · Telegram Post