CVE-2025-52553: Goauthentik Authentik authentication bypass (CVSS 9.6)

Description

authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, however this check is missing in versions prior to 2025.6.3 and 2025.4.3. When, for example, using RAC during a screenshare, a malicious user could access the same session by copying the URL from the shown browser. authentik 2025.4.3 and 2025.6.3 fix this issue. As a workaround, it is recommended to decrease the duration a token is valid for (in the RAC Provider settings, set Connection expiry to `minutes=5` for example). The maintainers of authentik also recommend enabling the option Delete authorization on disconnect.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Goauthentik Authentik≥ 2025.6.0 < 2025.6.3 · < 2025.4.3

Remediation

Fixed in

Goauthentik Authentik≥ 2025.6.3

Patch & vendor advisories

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-52553 being actively exploited?

CVE-2025-52553 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.52%.

How severe is CVE-2025-52553?

CVE-2025-52553 has a CVSS 3.1 base score of 9.6, rated critical. EPSS estimates a 0.52% probability of exploitation.

Which products are affected by CVE-2025-52553?

Affected products include Goauthentik Authentik.

How do I fix CVE-2025-52553?

Upgrade affected software to a fixed version, for example Goauthentik Authentik 2025.6.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-52553 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo