UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64708

Invitation expiry is delayed by at least 5 minutes

Severity
Medium 5.3
Published
19 Nov 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
2025.8.5, 2025.10.2
Also known as
GHSA-ch7q-53v8-73pc
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • From 2025.8.0 before 2025.8.5
  • From 2025.10.0 before 2025.10.2
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2025.10.2
  • Every version before 2025.8.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64708
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64708
  • GitHub Advisory Database https://github.com/advisories/GHSA-ch7q-53v8-73pc
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc