Skip to main content
cve.nowby Sazabi
← Go
GoPackage

goauthentik.io

6 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 high, 3 medium
Registry
pkg.go.dev

Advisories 6

  • authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

    Affected: fixed in 0.0.0-20260528144335-a370d76d23c7.

  • CVE-2025-64708Medium 5.8

    authentik invitation expiry is delayed by at least 5 minutes

    Affected: all versions; fixed in 0.0.0-20251119135424-6672e6aaa41e.

  • CVE-2025-64521Medium 4.8

    authentik deactivated service accounts can authenticate to OAuth

    Affected: all versions; fixed in 0.0.0-20251119140106-9dbdfc3f1be0.

  • authentik has an insufficient check for account active status during OAuth/SAML authentication

    Affected: fixed in 0.0.0-20250722122105-7a4c6b9b50f8; all versions.

  • authentik has Insufficient Authorization for several API endpoints

    Affected: all versions; from 2024.6.0-rc1, fixed in 2024.6.4; fixed in 2024.4.4.

  • CVE-2024-23647Medium 6.5

    PKCE downgrade attack in Authentik

    Affected: all versions; from 2023.10.0, fixed in 2023.10.7; fixed in 2023.8.7.