CVE-2025-52553: 
NixOS vulnerability analysis and mitigation

CVE-2025-52553 is an improper authentication vulnerability in authentik, an open-source identity provider, affecting its Remote Access Control (RAC) feature. The flaw was reported by SPIEGEL-Verlag and disclosed on June 27, 2025. It affects all authentik versions prior to 2025.4.3 and versions 2025.6.0 through 2025.6.2 (prior to 2025.6.3). The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a missing session-binding check (CWE-287: Improper Authentication) in authentik's RAC provider. When a user authorizes a RAC endpoint connection, authentik generates a single-use ConnectionToken and embeds it in the redirect URL sent to the client. However, the token validation logic in both authentik/providers/rac/views.py (RACInterface.dispatch) and authentik/providers/rac/consumer_client.py (init_outpost_connection) only verified that the token was unexpired — it did not verify that the requesting session matched the session that originally authorized the token. The fix adds a session__session__session_key filter to ConnectionToken.filter_not_expired() in both locations, ensuring the token can only be consumed by the originating session (GitHub Commit, GitHub Advisory).

A malicious actor who obtains a valid RAC connection token URL — for example, by observing a victim's browser during a screen share — can use that URL from a different session to hijack the remote access connection. This grants the attacker full access to the RAC session, including the confidentiality, integrity, and availability of the systems accessible through that remote connection. The impact is primarily on subsequent (downstream) systems reachable via the RAC endpoint, with high confidentiality, integrity, and availability impact on those systems (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (0.000410), indicating a low probability of near-term exploitation. Exploitation requires user interaction — specifically, an attacker must obtain the token-bearing URL from the victim (e.g., via screen sharing), making opportunistic mass exploitation unlikely (GitHub Advisory).

1. Identify a target: Locate an organization using authentik with the RAC (Remote Access Control) provider enabled and running a vulnerable version (prior to 2025.4.3 or 2025.6.0–2025.6.2).
2. Obtain the token URL: Position to observe the victim's browser URL bar — for example, during a screen share, video call, or by gaining access to browser history, logs, or referrer headers. The RAC connection URL contains the single-use ConnectionToken as a URL parameter.
3. Copy the token URL: Extract the full RAC connection URL including the token from the observed browser session.
4. Access the RAC session: Open the copied URL in a different browser or session. Because the vulnerable versions do not validate that the token belongs to the requesting session, authentik accepts the token and grants access to the remote session.
5. Achieve session hijack: The attacker now has full access to the RAC-connected remote system, able to interact with it as if they were the authorized user (GitHub Advisory, GitHub Commit).

• Logs: authentik access logs showing the same RAC connection token URL accessed from two different session IDs or IP addresses within a short time window; unexpected RAC session initiations from unfamiliar IP addresses or user agents.
• Network: RAC WebSocket connections (/ws/client/<token>/) originating from IP addresses not associated with the authorizing user's session.
• Application Behavior: RAC sessions appearing active for a user who has already disconnected or logged out; duplicate concurrent RAC sessions for the same token.
• Authentication Events: authentik audit logs showing a ConnectionToken consumed by a session that did not originate the authorization flow (GitHub Advisory).

Upgrade authentik to version 2025.4.3 or 2025.6.3, which add session-key validation to the ConnectionToken lookup in both the RAC view and WebSocket consumer (GitHub Commit). For organizations unable to upgrade immediately, two workarounds are recommended: (1) reduce the RAC Provider Connection expiry setting to a short duration such as minutes=5 to limit the window of token validity, and (2) enable the Delete authorization on disconnect option to invalidate tokens immediately after a session ends (GitHub Advisory).

The vulnerability was reported to the authentik maintainers by SPIEGEL-Verlag (the German media group), as credited in the official patch commit documentation. The advisory was published by maintainer BeryJu (Jens Langhammer) on June 27, 2025. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Commit, GitHub Advisory).