Skip to content
OpenAdvisories

Package · Go

goauthentik.io

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.5
    CVE-2026-47201

    authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

    authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstr…

    goauthentik authentik goauthentik.io Go
  • High 7.1
    CVE-2025-53942

    authentik has an insufficient check for account active status during OAuth/SAML authentication

    authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through …

    goauthentik authentik goauthentik.io Go
  • High 7.5
    CVE-2024-42490

    authentik has Insufficient Authorization for several API endpoints

    authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto…

    goauthentik authentik goauthentik.io Go