CVE-2025-64521
Medium · 4.8authentik allows a deactivated Service account to authenticate to OAuth
CVSS
4.8
EPSS
0.2%
Published
Nov 19, 2025
CISA due date
—
The record
When authenticating with `client_id` and `client_secret` to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and federation with other providers still take assigned policies correctly into account.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | goauthentik.io | 0 | No fix |
| Go | goauthentik.io | 0 | 0.0.0-20251119140106-9dbdfc3f1be0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251230T014957-150000.1.134.1 |
Related vulnerabilities
- GO-2025-4137 authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io Same vulnerability
- GO-2025-4136 authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io Also affects goauthentik.io
- CVE-2025-64708 authentik's invitation expiry is delayed by at least 5 minutes Also affects goauthentik.io
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb