CVE-2025-64521

Go/goauthentik.io CVE-2025-64521: medium 4.8, EPSS 0.23%

authentik allows a deactivated Service account to authenticate to OAuth

Action: Upgrade goauthentik.io to 0.0.0-20251119140106-9dbdfc3f1be0 or later.

go get goauthentik.io@v0.0.0-20251119140106-9dbdfc3f1be0

Affected

Fixed versions

Sources

• osv: GHSA-xr73-jq5p-ch8r
• https://github.com/goauthentik/authentik/security/advisories/GHSA-xr73-jq5p-ch8r
• https://nvd.nist.gov/vuln/detail/CVE-2025-64521
• https://github.com/goauthentik/authentik/commit/9dbdfc3f1be0f1be36f8efce2442897b2a54a71c
• https://github.com/goauthentik/authentik

CVE-2025-64521 · published 2025-11-19T18:13:03Z · modified 2026-07-13T07:26:54.452545220Z · JSON

Go/goauthentik.io CVE-2025-64521: unknown, EPSS 0.23%

authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2025-4137
• https://github.com/goauthentik/authentik/security/advisories/GHSA-xr73-jq5p-ch8r
• https://nvd.nist.gov/vuln/detail/CVE-2025-64521
• https://github.com/goauthentik/authentik/commit/9dbdfc3f1be0f1be36f8efce2442897b2a54a71c

CVE-2025-64521 · published 2025-12-15T20:33:49Z · modified 2026-07-13T07:26:54.452545220Z · JSON

PyPI/authentik-client CVE-2025-64521: medium 4.8, EPSS 0.23%

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account

Action: Upgrade authentik-client to 2025.8.5 or later.

pip install authentik-client==2025.8.5

pip install authentik-client==2025.10.2

Affected

Fixed versions

Sources

• osv: PYSEC-2025-237
• https://github.com/goauthentik/authentik/commit/9dbdfc3f1be0f1be36f8efce2442897b2a54a71c
• https://github.com/goauthentik/authentik/security/advisories/GHSA-xr73-jq5p-ch8r

CVE-2025-64521 · published 2025-11-19T17:15:52.033Z · modified 2026-07-13T07:26:54.452545220Z · JSON