OAuth Service Account Authentication Issue in Authentik by Goauthentik

CVE-2025-64521

What is CVE-2025-64521?

Authentik, an open-source Identity Provider, earlier versions prior to 2025.8.5 and 2025.10.2, exhibit a flaw that permits authentication of service accounts with client_id and client_secret, even when those accounts are marked as deactivated. This oversight poses significant security risks, as the appropriate permissions set for other actions remain intact, ensuring that federation with other providers still adheres to assigned policies. It is recommended that users implement a policy that checks the validity of the service accounts to mitigate risks until they can upgrade to the patched versions.

References