SB2025111950 - Multiple vulnerabilities in authentik

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper authentication (CVE-ID: CVE-2025-64521)

The vulnerability allows a remote user to bypass authentication process.

The vulnerability exists due to an error in processing authentication requests within the OAuth provider. A remote user can login with the deactivated account. 

2) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2025-64708)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to authentik considers invitations valid regardless of their expiration date relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer. This allows a remote attacker to guess invitation token and gain unauthorized access to the application. 

Remediation

Install update from vendor's website.

References

• https://github.com/goauthentik/authentik/security/advisories/GHSA-xr73-jq5p-ch8r
• https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc