Go modules package
goauthentik.io
pkg:golang/goauthentik.io
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-64708 | — | < 0.0.0-20251119135424-6672e6aaa41e | 0.0.0-20251119135424-6672e6aaa41e | Nov 19, 2025 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this c | ||
| CVE-2025-64521 | — | < 0.0.0-20251119140106-9dbdfc3f1be0 | 0.0.0-20251119140106-9dbdfc3f1be0 | Nov 19, 2025 | authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this accoun | ||
| CVE-2025-53942 | — | < 0.0.0-20250722122105-7a4c6b9b50f8 | 0.0.0-20250722122105-7a4c6b9b50f8 | Jul 23, 2025 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked | ||
| CVE-2024-42490 | — | >= 2024.6.0-rc1, < 2024.6.4 | 2024.6.4 | Aug 22, 2024 | authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//view_certificate/, /api/v3/crypto/certificatekeypairs/ | ||
| CVE-2024-23647 | — | >= 2023.10.0, < 2023.10.7 | 2023.10.7 | Jan 30, 2024 | Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token |
- CVE-2025-64708Nov 19, 2025affected < 0.0.0-20251119135424-6672e6aaa41efixed 0.0.0-20251119135424-6672e6aaa41e
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this c
- CVE-2025-64521Nov 19, 2025affected < 0.0.0-20251119140106-9dbdfc3f1be0fixed 0.0.0-20251119140106-9dbdfc3f1be0
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this accoun
- CVE-2025-53942Jul 23, 2025affected < 0.0.0-20250722122105-7a4c6b9b50f8fixed 0.0.0-20250722122105-7a4c6b9b50f8
authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked
- CVE-2024-42490Aug 22, 2024affected >= 2024.6.0-rc1, < 2024.6.4fixed 2024.6.4
authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs//view_certificate/, /api/v3/crypto/certificatekeypairs/
- CVE-2024-23647Jan 30, 2024affected >= 2023.10.0, < 2023.10.7fixed 2023.10.7
Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier parameter to the token