OAuth Service Account Authentication Issue in Authentik by Goauthentik

CVE-2025-64521

What is CVE-2025-64521?

Authentik, an open-source Identity Provider, earlier versions prior to 2025.8.5 and 2025.10.2, exhibit a flaw that permits authentication of service accounts with client_id and client_secret, even when those accounts are marked as deactivated. This oversight poses significant security risks, as the appropriate permissions set for other actions remain intact, ensuring that federation with other providers still adheres to assigned policies. It is recommended that users implement a policy that checks the validity of the service accounts to mitigate risks until they can upgrade to the patched versions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References