CVE-2025-64708
Medium · 5.8authentik's invitation expiry is delayed by at least 5 minutes
CVSS
5.8
EPSS
0.3%
Published
Nov 19, 2025
CISA due date
—
The record
In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | goauthentik.io | 0 | No fix |
| Go | goauthentik.io | 0 | 0.0.0-20251119135424-6672e6aaa41e |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251230T014957-150000.1.134.1 |
Related vulnerabilities
- GO-2025-4136 authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io Same vulnerability
- GO-2025-4137 authentik allows a deactivated Service account to authenticate to OAuth in goauthentik.io Also affects goauthentik.io
- CVE-2025-64521 authentik allows a deactivated Service account to authenticate to OAuth Also affects goauthentik.io
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb