{"action":"Upgrade authentik-client to 2025.8.5 or later.","affected":[{"fixed":"2025.8.5","introduced":"2025.8.0"},{"fixed":"2025.10.2","introduced":"2025.10.0"}],"component":"authentik-client","cve_ids":["CVE-2025-64521"],"ecosystem":"PyPI","epss":0.00234,"exploited":false,"fixed_versions":["2025.8.5","2025.10.2"],"ghsa_id":"GHSA-xr73-jq5p-ch8r","id":"tcs_01M5KGPC2AZ4NGWEBWPMMET4EJ","modified_at":"2026-07-13T07:26:54.452545220Z","published_at":"2025-11-19T17:15:52.033Z","references":["https://osv.dev/vulnerability/PYSEC-2025-237","https://github.com/goauthentik/authentik/commit/9dbdfc3f1be0f1be36f8efce2442897b2a54a71c","https://github.com/goauthentik/authentik/security/advisories/GHSA-xr73-jq5p-ch8r"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"PYSEC-2025-237","url":"https://osv.dev/vulnerability/PYSEC-2025-237"}],"summary":"authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account"}