Skip to main content

Session Fixation

CVE-2025-29928

High
8/10

Summary

The authentik is an open-source identity provider. In versions prior to 2024.12.4, and 2025.2.x priotr to 2025.2.3, when authentik was configured to use the database for "session storage" (which is a non-default setting), deleting sessions via the "Web Interface" or the API would not revoke the session and the session holder would continue to have access to authentik. Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate.

  • HIGH
  • NETWORK
  • HIGH
  • CHANGED
  • REQUIRED
  • NONE
  • HIGH
  • NONE

CWE-384 - Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References

Advisory Timeline

  • Published