CVE-2025-29928

Katalog CVE

CVSS 8.0 · High EPSS 0,39%

Kerentanan Session Fixation pada goauthentik authentik. Skor CVSS 3.1 8.0 (High) menurut github.com.

Deskripsi (NVD)

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate.

Rincian

Terbit di NVD

28 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/goauthentik/authentik/security/advisories/GHSA-p6p8-f853-9g2p advisory vendor
• https://github.com/goauthentik/authentik/commit/71294b7deb6eb5726a782de83b957eaf25fc4cf6 patch