Skip to content
OpenAdvisories

Package · Go

goauthentik.io

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.8
    CVE-2025-64708

    authentik invitation expiry is delayed by at least 5 minutes

    authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a n…

    goauthentik authentik goauthentik.io Go
  • Medium 4.8
    CVE-2025-64521

    authentik deactivated service accounts can authenticate to OAuth

    authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentic…

    goauthentik authentik goauthentik.io authentik-client PyPI Go
  • Medium 6.5
    CVE-2024-23647

    PKCE downgrade attack in Authentik

    Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier p…

    goauthentik authentik goauthentik.io Go