GHSA-6JHG-HG63-JVVF vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, airflow, awx, kubeflow-pipelines-visualization-server, authentik, py3-cassandra-medusa, py3-vllm-cuda-12.4, checkov, gitlab-cng, open-webui, request-1276, kserve, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes...

CVE-2025-69230 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, airflow, awx, kubeflow-pipelines-visualization-server, authentik, py3-cassandra-medusa, py3-vllm-cuda-12.4, checkov, gitlab-cng, open-webui, request-1276, kserve, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes...

CVE-2025-69227 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, airflow, awx, kubeflow-pipelines-visualization-server, authentik, py3-cassandra-medusa, py3-vllm-cuda-12.4, checkov, gitlab-cng, open-webui, request-1276, kserve, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes...

GHSA-JJ3X-WXRX-4X23 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, airflow, awx, kubeflow-pipelines-visualization-server, authentik, py3-cassandra-medusa, py3-vllm-cuda-12.4, checkov, gitlab-cng, open-webui, request-1276, kserve, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes...

GHSA-FH55-R93G-J68G vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, airflow, awx, kubeflow-pipelines-visualization-server, authentik, py3-cassandra-medusa, py3-vllm-cuda-12.4, checkov, gitlab-cng, open-webui, request-1276, kserve, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes...

GHSA-54JQ-C3M8-4M76 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, airflow, awx, kubeflow-pipelines-visualization-server, authentik, py3-cassandra-medusa, py3-vllm-cuda-12.4, checkov, gitlab-cng, open-webui, request-1276, kserve, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes...

CVE-2025-69228 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, airflow, awx, kubeflow-pipelines-visualization-server, authentik, py3-cassandra-medusa, py3-vllm-cuda-12.4, checkov, gitlab-cng, open-webui, request-1276, kserve, py3.13-scanner-test-libraries-aiohttp, dask-kubernetes...

SUSE CVE-2025-64521

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even...

SUSE CVE-2025-64708

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5...

CVE-2025-68131 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, authentik, localstack, tritonserver-backend-vllm-cuda-12.9, authentik-fips...

GHSA-WCJ4-JW5J-44WH vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, authentik, localstack, tritonserver-backend-vllm-cuda-12.9, authentik-fips...

GO-2025-4137 authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io

authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GHSA-VRCR-9HJ9-JCG6 vulnerabilities

Vulnerabilities for packages: awx, authentik...

CVE-2025-64460 vulnerabilities

Vulnerabilities for packages: awx, authentik...

GHSA-RQW2-GHQ9-44M7 vulnerabilities

Vulnerabilities for packages: awx, authentik...

CVE-2025-13372 vulnerabilities

Vulnerabilities for packages: awx, authentik...

CVE-2025-64708

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5...

GHSA-CH7Q-53V8-73PC authentik's invitation expiry is delayed by at least 5 minutes

Summary In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes...

authentik's invitation expiry is delayed by at least 5 minutes

Summary In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes...

GHSA-XR73-JQ5P-CH8R authentik allows a deactivated Service account to authenticate to OAuth

Summary When authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and...