CVE-2025-64708

MEDIUM EPSS 12.0%
Published Nov 19, 20257mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Nov 19, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago

Description

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer. authentik versions 2025.8.5 and 2025.10.2 fix this issue. A workaround involves creating a policy that explicitly checks whether the invitation is still valid, and then bind it to the invitation stage on the invitation flow, and denying access if the invitation is not valid.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
12.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-613

Affected Products 2

VendorProductVersionRange
goauthentikauthentik*≥2025.8.0  –  <2025.8.5
goauthentikauthentik*≥2025.10.0  –  <2025.10.2

References 2

  • github.com https://github.com/goauthentik/authentik/commit/6672e6aaa41e0f2c9bfb1e4d8b51cf114969e830
    Patch
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc
    PatchVendor Advisory

Remediation

  • github.com https://github.com/goauthentik/authentik/commit/6672e6aaa41e0f2c9bfb1e4d8b51cf114969e830
    Patch
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc
    PatchVendor Advisory