GO-2025-4137
NoneCVSS
—
EPSS
—
Published
Dec 15, 2025
CISA due date
—
The record
authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | goauthentik.io | 0 | No fix |
| Go | goauthentik.io | 0 | 0.0.0-20251119140106-9dbdfc3f1be0 |
Related vulnerabilities
- CVE-2025-64521 authentik allows a deactivated Service account to authenticate to OAuth Same vulnerability
- GO-2025-4136 authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io Also affects goauthentik.io
- CVE-2025-64708 authentik's invitation expiry is delayed by at least 5 minutes Also affects goauthentik.io