habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: fix CVE-2025-29928 (cherry-pick #13695) (#13700)

Browse Source 
security: fix CVE-2025-29928 (#13695)

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Jens L. <jens@goauthentik.io>
This commit is contained in:
gcp-cherry-pick-bot[bot]
2025-03-28 14:32:55 +01:00
committed by GitHub
parent cc214a0eb7
commit d6c35787b0
4 changed files with 40 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
website/docs/security/cves/CVE-2025-29928.md Normal file
View File

@ -0,0 +1,23 @@
# CVE-2025-29928
## Deletion of sessions did not revoke sessions when using database session storage
### Summary
When authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik.
This also affects automatic session deletion when a user is set to inactive or a user is deleted.
### Patches
authentik 2025.2.3 and 2024.12.4 fix this issue.
### Workarounds
Switching to the cache-based session storage until the authentik instance can be upgraded is recommended.
### For more information
If you have any questions or comments about this advisory:
- Email us at [security@goauthentik.io](mailto:security@goauthentik.io).