GHSA-54JQ-C3M8-4M76 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3.13-scanner-test-libraries-aiohttp, kserve, open-webui, checkov, dask-kubernetes, request-1276, airflow, awx, py3-cassandra-medusa, py3-vllm-cuda-12.4, gitlab-cng, apache-beam-python-3.11-sdk, authentik...

GHSA-FH55-R93G-J68G vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3.13-scanner-test-libraries-aiohttp, kserve, open-webui, checkov, dask-kubernetes, request-1276, airflow, awx, py3-cassandra-medusa, py3-vllm-cuda-12.4, gitlab-cng, apache-beam-python-3.11-sdk, authentik...

SUSE CVE-2025-64521

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even...

SUSE CVE-2025-64708

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5...

CVE-2025-68131 vulnerabilities

Vulnerabilities for packages: localstack, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, authentik-fips, authentik...

GHSA-WCJ4-JW5J-44WH vulnerabilities

Vulnerabilities for packages: localstack, tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, authentik-fips, authentik...

GO-2025-4137 authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io

authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GHSA-VRCR-9HJ9-JCG6 vulnerabilities

Vulnerabilities for packages: authentik, awx...

CVE-2025-64460 vulnerabilities

Vulnerabilities for packages: authentik, awx...

GHSA-RQW2-GHQ9-44M7 vulnerabilities

Vulnerabilities for packages: authentik, awx...

CVE-2025-13372 vulnerabilities

Vulnerabilities for packages: authentik, awx...

CVE-2025-64708

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5...

GHSA-CH7Q-53V8-73PC authentik's invitation expiry is delayed by at least 5 minutes

Summary In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes...

authentik's invitation expiry is delayed by at least 5 minutes

Summary In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes...

GHSA-XR73-JQ5P-CH8R authentik allows a deactivated Service account to authenticate to OAuth

Summary When authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and...

PYSEC-2025-237

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even...

CVE-2025-64708

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5...

CVE-2025-64521

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even...

CVE-2025-64708 authentik invitation expiry is delayed by at least 5 minutes

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5...

CVE-2025-64708

The vulnerability CVE-2025-64708 affects authentik (open-source Identity Provider). Prior to versions 2025.8.5 and 2025.10.2, invitations remained valid despite expiration, relying on background cleanup every 5 minutes. In normal operation this cleanup can take up to 5 minutes, but with a large b...