Skip to content
OpenAdvisories

Package · Go

goauthentik.io

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 8.5
    CVE-2026-47201

    authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

    authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstr…

    goauthentik authentik goauthentik.io Go
  • Medium 5.8
    CVE-2025-64708

    authentik invitation expiry is delayed by at least 5 minutes

    authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a n…

    goauthentik authentik goauthentik.io Go
  • Medium 4.8
    CVE-2025-64521

    authentik deactivated service accounts can authenticate to OAuth

    authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentic…

    goauthentik authentik goauthentik.io authentik-client PyPI Go
  • High 7.1
    CVE-2025-53942

    authentik has an insufficient check for account active status during OAuth/SAML authentication

    authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through …

    goauthentik authentik goauthentik.io Go
  • High 7.5
    CVE-2024-42490

    authentik has Insufficient Authorization for several API endpoints

    authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto…

    goauthentik authentik goauthentik.io Go
  • Medium 6.5
    CVE-2024-23647

    PKCE downgrade attack in Authentik

    Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier p…

    goauthentik authentik goauthentik.io Go