CVE-2025-64521: Goauthentik.io Authentik Allows A Deactivated Service Vulnerability

MODERATE
Advisory Identifier: GHSA-xr73-jq5p-ch8r
Share
CVSS 4.8
CWE-289 CWE-286
Published
Advisory Summary

CVE-2025-64521 is a MODERATE (CVSS 4.8) authentik allows a deactivated service vulnerability (CWE-289: Authentication Bypass by Alternate Name) affecting Goauthentik.io libraries in the Go ecosystem. The issue involves authentik allows a deactivated service account to authenticate to oauth. Remediation is available by upgrading affected packages to version 0.0.0-20251119140106-9dbdfc3f1be0.

CVE-2025-64521 at a Glance

CVE Identifier CVE-2025-64521
GHSA Identifier GHSA-xr73-jq5p-ch8r
Severity MODERATE
CVSS v3.1 Base Score 4.8
CWE Classification CWE-289: Authentication Bypass by Alternate Name
Affected Product Goauthentik.io
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 4.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required High (PR:H)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2025-64521

To remediate this vulnerability, upgrade all affected Goauthentik.io dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

goauthentik.io fixed: 0.0.0-20251119140106-9dbdfc3f1be0 
Upgrade goauthentik.io to 0.0.0-20251119140106-9dbdfc3f1be0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for goauthentik.io

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-64521, inspect your project dependencies for Goauthentik.io:

inspect dependencies for goauthentik.io

Analyze the terminal output to locate any version of Goauthentik.io in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20251119140106-9dbdfc3f1be0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-289: Authentication Bypass by Alternate Name, where the product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor. In Goauthentik.io, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary When authenticating with `client_id` and `client_secret` to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and federation with other providers still take assigned policies correctly into account. ### Patches authentik 2025.8.5 and 2025.10.2 fix this issue, for other versions the workaround below can be used. ### Workarounds You can add a policy to your application that explicitly checks if the service account is still valid, and deny access if not. ```python return request.user.is_active ``` ### For more information If you have any questions or comments about this advisory: - Email us at [security@goauthentik.io](mailto:security@goauthentik.io).

CVE-2025-64521 Affected Goauthentik.io Versions

1 component(s)
Fixed Versions:
0.0.0-20251119140106-9dbdfc3f1be0
Product / Package Ecosystem Affected Versions Fixed Version
goauthentik.io
golang/goauthentik.io
Go
< 0.0.0-20251119140106-9dbdfc3f1be0
0.0.0-20251119140106-9dbdfc3f1be0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/goauthentik/authentik/security/advisories/GHSA-xr73-jq5p-ch8r
NVD — CVE-2025-64521 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64521
Security Fix Commit FIX COMMIT
https://github.com/goauthentik/authentik/commit/9dbdfc3f1be0f1be36f8efce2442897b2a54a71c
Goauthentik.io Source Repository REPOSITORY
https://github.com/goauthentik/authentik

Frequently Asked Questions

What is CVE-2025-64521?
CVE-2025-64521 is a security vulnerability in Goauthentik.io involving authentik allows a deactivated Service account to authenticate to OAuth under CWE-289: Authentication Bypass by Alternate Name.
Which Goauthentik.io versions are affected?
Affected versions include releases prior to 0.0.0-20251119140106-9dbdfc3f1be0 across affected packages: goauthentik.io.
What version fixes CVE-2025-64521?
Upgrading to 0.0.0-20251119140106-9dbdfc3f1be0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is goauthentik.io affected?
Yes, goauthentik.io is affected in releases prior to 0.0.0-20251119140106-9dbdfc3f1be0. Upgrade your dependency to 0.0.0-20251119140106-9dbdfc3f1be0 or later.
What is the CVSS score of CVE-2025-64521?
CVE-2025-64521 has a CVSS v3.1 base score of 4.8 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
What CWE is associated with CVE-2025-64521?
CVE-2025-64521 is classified under CWE-289: Authentication Bypass by Alternate Name (The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.).
How can I check Go dependencies for CVE-2025-64521?
Run the dependency tree command: 'inspect dependencies for goauthentik.io'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xr73-jq5p-ch8r",
  "modified" : "2025-11-19T18:59:53Z",
  "published" : "2025-11-19T18:13:03Z",
  "aliases" : [ "CVE-2025-64521" ],
  "summary" : "authentik allows a deactivated Service account to authenticate to OAuth",
  "details" : "### Summary\n\nWhen authenticating with `client_id` and `client_secret` to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and federation with other providers still take assigned policies correctly into account.\n\n### Patches\n\nauthentik 2025.8.5 and 2025.10.2 fix this issue, for other versions the workaround below can be used.\n\n### Workarounds\n\nYou can add a policy to your application that explicitly checks if the service account is still valid, and deny access if not.\n\n```python\nreturn request.user.is_active\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Email us at [security@goauthentik.io](mailto:security@goauthentik.io).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "goauthentik.io"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20251119140106-9dbdfc3f1be0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/goauthentik/authentik/security/advisories/GHSA-xr73-jq5p-ch8r"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-64521"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/goauthentik/authentik/commit/9dbdfc3f1be0f1be36f8efce2442897b2a54a71c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/goauthentik/authentik"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-286", "CWE-289" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-11-19T18:13:03Z",
    "nvd_published_at" : "2025-11-19T17:15:52Z"
  }
}