Executive Summary

This vulnerability in authentik, an open-source Identity Provider, involves invitations being considered valid even if they have expired. The system relies on background tasks to clean up expired invitations every 5 minutes, but if there is a backlog, expired invitations may remain valid longer than intended. This allows potentially expired invitations to be used until the cleanup task runs. Versions 2025.8.5 and 2025.10.2 fix this issue by addressing the validation of invitations. A workaround is to create a policy that explicitly checks invitation validity and denies access if the invitation is expired.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing expired invitations to be used to gain access to the system, potentially bypassing intended access controls. This could lead to unauthorized access if expired invitations are exploited before the cleanup task removes them, especially in scenarios with a large backlog of tasks delaying cleanup.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you can create a policy that explicitly checks whether the invitation is still valid, bind this policy to the invitation stage on the invitation flow, and deny access if the invitation is not valid. Additionally, upgrading authentik to versions 2025.8.5 or 2025.10.2 will fix the issue.

Useful 0 Not Useful 0