CVE-2025-52553

Executive Summary

CVE-2025-52553 is a critical security vulnerability in authentik, an open-source identity provider. The flaw resides in the Remote Access Control (RAC) feature. After a user authorizes a RAC connection, a single-use token is generated and sent to the client via the URL. In vulnerable versions (prior to 2025.6.3 and 2025.4.3), this token is not properly scoped to the user's session. This means that if a user shares their screen (e.g., during a screenshare), a malicious observer who copies the URL can reuse that token to access the same RAC session without authorization. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement of user interaction and the potential for session hijacking in collaborative environments.

Supply Chain & Package Security

This vulnerability affects the authentik Docker images and Python packages. Administrators should verify their deployment version and update to the patched releases (2025.4.3 or 2025.6.3). No malicious packages have been reported in the supply chain, but the token reuse issue is a direct result of missing session validation logic.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The token is transmitted over the network via URL.
• Attack Complexity (AC): Low (L) – No special conditions required beyond capturing the URL.
• Privileges Required (PR): Low (L) – Attacker needs to be a user with access to the RAC session URL.
• User Interaction (UI): Required (R) – Victim must share their screen or otherwise expose the URL.
• Scope (S): Unchanged (U) – The vulnerable component is the RAC token.
• Confidentiality (C): High (H) – Attacker can view the remote session.
• Integrity (I): None (N) – No modification possible.
• Availability (A): None (N) – No denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Base Score: 5.7 (Medium)
Threat Level: Medium – Exploitation requires user interaction but is trivial once the URL is obtained.

Deep Dive & Mechanics

The RAC feature in authentik allows authorized users to remotely access endpoints (e.g., SSH, RDP, web apps). The flow is:

1. User authenticates and requests access to a RAC endpoint.
2. authentik generates a single-use token and redirects the user to the RAC proxy with the token in the URL (e.g., https://rac-proxy.example.com/connect?token=abc123).
3. The proxy validates the token and establishes the connection.

In vulnerable versions, the token is not bound to the user's session ID. This means:

• The token is valid for any user who possesses it, regardless of their authentication state.
• If the URL is exposed (e.g., via screenshare, browser history, or logs), an attacker can copy it and use it to access the same RAC session.
• The token remains valid until it expires (default expiry may be long) or is used.

The fix in versions 2025.4.3 and 2025.6.3 adds a session check: the token is now tied to the user's session, so only the original user can use it. Additionally, the "Delete authorization on disconnect" option ensures the token is invalidated when the connection ends.

Vulnerable vs. Patched Code

Vulnerable Code (simplified pseudocode):

def create_rac_token(user, endpoint):
    token = generate_random_token()
    store_token(token, endpoint, expiry=config.RAC_TOKEN_EXPIRY)
    return token

def validate_rac_token(token):
    data = lookup_token(token)
    if data and not expired(data):
        return data.endpoint
    return None

No session check is performed.

Patched Code (simplified pseudocode):

def create_rac_token(user, endpoint):
    token = generate_random_token()
    store_token(token, endpoint, user.session_id, expiry=config.RAC_TOKEN_EXPIRY)
    return token

def validate_rac_token(token, session_id):
    data = lookup_token(token)
    if data and not expired(data) and data.session_id == session_id:
        return data.endpoint
    return None

The token is now bound to the user's session ID.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an authentik instance with RAC enabled (vulnerable version).
• A legitimate user who will authorize a RAC connection and share their screen.

Steps:

1. Victim logs into authentik and authorizes a RAC connection to a target endpoint.
2. Victim shares their screen (e.g., via Zoom, Teams) showing the browser with the RAC URL.
3. Attacker copies the URL from the screen recording or screenshot.
4. Attacker opens the URL in their own browser.
5. Attacker gains access to the same RAC session (e.g., SSH, RDP) without authentication.

Proof of Concept (PoC) Code:

# No exploit code available; this is a logical flaw.
# The attack is purely based on URL capture and reuse.

Blue Team (Defense & Detection)

Detection:

• Monitor for multiple connections using the same RAC token (check logs for token reuse).
• Alert on RAC connections from IP addresses that differ from the original authorizing user's IP.
• Enable "Delete authorization on disconnect" to invalidate tokens immediately.

Hunting Query (Splunk):

index=authentik sourcetype=rac_access
| stats values(src_ip) as ips, values(user) as users by token
| where mvcount(ips) > 1 OR mvcount(users) > 1

Indicators of Compromise (IOCs)

• Network: RAC token in URL (e.g., ?token=<base64_or_hex_string>)
• Logs: Multiple rac_connect events with the same token from different source IPs or users.
• Behavior: RAC session accessed from an IP not associated with the original authorizing user.

Detection Engineering

YARA Rule

rule CVE_2025_52553_RAC_Token_Reuse {
    meta:
        description = "Detects RAC token reuse in authentik logs"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-52553"
    strings:
        $token_reuse = /token=[a-f0-9]{32,}/ nocase
        $rac_connect = "rac_connect" nocase
    condition:
        #token_reuse >= 2 and #rac_connect >= 2
}

Sigma Rule

title: Authentik RAC Token Reuse Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple RAC connections using the same token from different sources
author: Valters IT
date: 2025/04/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52553
logsource:
    product: authentik
    service: rac
detection:
    selection:
        event: rac_connect
    condition: selection | count(token) by token > 1
falsepositives:
    - Legitimate token refresh (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52553 - Authentik RAC Token Reuse"; flow:to_server; content:"rac/connect"; nocase; content:"token="; nocase; pcre:"/token=[a-f0-9]{32,}/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to authentik 2025.4.3 or 2025.6.3 (or later).
2. If upgrade is not possible, set RAC Provider "Connection expiry" to a short duration (e.g., minutes=5).
3. Enable "Delete authorization on disconnect" in RAC Provider settings.

Long-term Hardening:

• Implement additional session binding for all tokens.
• Educate users not to share screens containing URLs with tokens.
• Use URL masking or token-in-header mechanisms instead of URL parameters.

Patch Verification:

# Check current version
docker exec authentik-server authentik version
# Expected output: 2025.4.3 or 2025.6.3 or higher

Valters IT