CVE-2025-52553: Critical Session Flaw in authentik RAC

CVE-2025-52553 is a critical session check flaw (CVSS 9.6) in authentik, the open source identity provider. Its Remote Access Control token was not tied to the user's session before 2025.4.3 and 2025.6.3. Upgrade to one of those releases, or shorten the connection expiry as a workaround.

What's affected

The CVE record says the missing check affects authentik versions before 2025.6.3 and before 2025.4.3, and that authentik 2025.4.3 and 2025.6.3 fix it. After a user is authorized to reach a Remote Access Control (RAC) endpoint, authentik creates a token for a single connection and sends it to the client in the URL. The token is meant to be valid only for the session of the user who authorized the connection, and that check was missing.

The weakness is CWE-287 (improper authentication). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, a network reachable flaw with scope change that needs user interaction. The record gives a concrete example: a user sharing their screen during a RAC session could expose the URL, and another person who copied it could reach the same session. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and the record does not say it is exploited in the wild.

Only deployments that use RAC providers are relevant. Installs that do not use RAC do not use this feature.

How to check if you're exposed

Read your authentik version from the admin interface, or from the image tag if you run containers:

docker ps --format '{{.Names}} {{.Image}}'
helm list -A | grep -i authentik

You need 2025.4.3 or later on the 2025.4 line, or 2025.6.3 or later on the 2025.6 line. Other release lines should be checked in the project advisory.

Then see whether RAC is in use. In the admin interface, open the list of providers and look for any of type RAC. If there are none, the affected feature is not enabled. If there are some, check the Connection expiry value in each provider's settings and the option Delete authorization on disconnect.

What to do now

1. Check the authentik version of every instance.
2. Upgrade to 2025.4.3 or 2025.6.3, or a later release, following the project upgrade notes.
3. If you cannot upgrade yet, open each RAC provider and set Connection expiry to a short value, such as minutes=5, as the advisory suggests.
4. Enable the option Delete authorization on disconnect on RAC providers.
5. Ask users not to share their screen with the address bar visible during RAC sessions, and not to paste connection URLs into chats.
6. Review RAC connection logs for sessions that started from unfamiliar addresses.

Why it matters

Tokens in a URL are fragile. They end up in screen shares, browser history, proxy logs and chat messages. A design that puts a token in a URL is only safe if the token is useless to anyone except the person it was issued to. That is the check which was missing here: the token should have been bound to the session of the user who authorized the connection.

The impact is not a lot of people attacking from the internet. It is a person who sees the URL by accident, or on purpose, and gets access to a remote machine as someone else. For identity providers, which sit in front of many systems, that kind of lapse is serious.

The advisory workaround is sensible beyond this CVE. Short lived access and cleaning up authorizations on disconnect shrink the window for any leaked token.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-52553
• authentik GitHub security advisory GHSA-wr3v-9p2c-chx7, fetched (the page content was mostly site navigation, so facts come from the CVE record text that mirrors it): https://github.com/goauthentik/authentik/security/advisories/GHSA-wr3v-9p2c-chx7

Last reviewed: 18 October 2026.