Threats tagged 'ghsa-xr73-jq5p-ch8r'

A vulnerability in authentik's OAuth service account authentication allows deactivated service accounts to still authenticate using client credentials. This issue affects authentik versions prior to 0.0.0-20251119140106-9dbdfc3f1be0. The flaw does not affect other permissions or federation policies. Fixed versions are available, and a workaround involves adding a policy to explicitly check if the service account is active.