kratos
v26.2.0Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
- Maintenance
- SlowBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 2 advisories1 high, 1 medium · Scorecard 6.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
14k stars · 1.2k forks · 240 open issues · last release 7 months ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 2 most recent advisories published by the maintainers: 1 high, 1 medium. Check the patched version against the one you run.
- highCVE-2026-33503Mar 20, 2026SQL injection via forged pagination tokens
- Affected
- v25.4.0
- Patched in
- v26.2.0
- mediumCVE-2024-45042Sep 26, 2024Setting `highest_available` does not properly respect code + mfa credentials
- Affected
- <=1.2.0
- Patched in
- 1.3.0