CVE-2025-64708
BaseFortify
Publication date: 2025-11-19
Last updated on: 2025-11-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| goauthentik | authentik | From 2025.8.0 (inc) to 2025.8.5 (exc) |
| goauthentik | authentik | From 2025.10.0 (inc) to 2025.10.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in authentik, an open-source Identity Provider, involves invitations being considered valid even if they have expired. The system relies on background tasks to clean up expired invitations every 5 minutes, but if there is a backlog, expired invitations may remain valid longer than intended. This allows potentially expired invitations to be used until the cleanup task runs. Versions 2025.8.5 and 2025.10.2 fix this issue by addressing the validation of invitations. A workaround is to create a policy that explicitly checks invitation validity and denies access if the invitation is expired.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing expired invitations to be used to gain access to the system, potentially bypassing intended access controls. This could lead to unauthorized access if expired invitations are exploited before the cleanup task removes them, especially in scenarios with a large backlog of tasks delaying cleanup.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you can create a policy that explicitly checks whether the invitation is still valid, bind this policy to the invitation stage on the invitation flow, and deny access if the invitation is not valid. Additionally, upgrading authentik to versions 2025.8.5 or 2025.10.2 will fix the issue.