CVE-2025-64521: authentik deactivated service accounts can authenticate to OAuth
Summary
When authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and federation with other providers still take assigned policies correctly into account.
Patches
authentik 2025.8.5 and 2025.10.2 fix this issue, for other versions the workaround below can be used.
Workarounds
You can add a policy to your application that explicitly checks if the service account is still valid, and deny access if not.
python return request.user.isactive
For more information
If you have any questions or comments about this advisory:
- Email us at security@goauthentik.io.
Other sources
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with clientid and clientsecret to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and federation with other providers still take assigned policies correctly into account. authentik versions 2025.8.5 and 2025.10.2 fix this issue. A workaround involves adding a policy to the application that explicitly checks if the service account is still valid, and deny access if not.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64521?
CVE-2025-64521 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to service accounts.
How do I fix CVE-2025-64521?
To mitigate CVE-2025-64521, upgrade authentik to version 2025.8.5 or 2025.10.2 or later.
What versions of authentik are affected by CVE-2025-64521?
CVE-2025-64521 affects authentik versions prior to 2025.8.5 and 2025.10.2.
What is the impact of CVE-2025-64521 on OAuth provider authentication?
CVE-2025-64521 can lead to the creation of insecure service accounts during OAuth provider authentication.
Is CVE-2025-64521 publicly disclosed?
Yes, CVE-2025-64521 has been publicly disclosed through security advisories.