GO-2025-4136
NoneCVSS
—
EPSS
—
Published
Dec 15, 2025
CISA due date
—
The record
authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | goauthentik.io | 0 | No fix |
| Go | goauthentik.io | 0 | 0.0.0-20251119135424-6672e6aaa41e |
Related vulnerabilities
- CVE-2025-64708 authentik's invitation expiry is delayed by at least 5 minutes Same vulnerability
- GO-2025-4137 authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io Also affects goauthentik.io
- CVE-2025-64521 authentik allows a deactivated Service account to authenticate to OAuth Also affects goauthentik.io