TI-2025-40054 Aliases CVE-2025-64708 GHSA-ch7q-53v8-73pc

authentik invitation expiry is delayed by at least 5 minutes

LOW 32CWE-613Published 2025-11-19 · Updated 2025-11-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer. authentik versions 2025.8.5 and 2025.10.2 fix this issue. A workaround involves creating a policy that explicitly checks whether the invitation is still valid, and then bind it to the invitation stage on the invitation flow, and denying access if the invitation is not valid.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00265 18th percentileScored 2026-11-07

Fix Fixed authentik (goauthentik): 2025.10.2, 2025.8.5goauthentik.io (Go): 0.0.0-20251119135424-6672e6aaa41e

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
goauthentik	authentik	before 2025.10.2; before 2025.8.5	2025.10.2, 2025.8.5	Patch available	CNA
—	goauthentik.io (Go)	before 0.0.0-20251119135424-6672e6aaa41e	0.0.0-20251119135424-6672e6aaa41e	Patch available	GHSA-ch7q-53v8-73pc

authentik Vendorgoauthentik Affected before 2025.10.2; before 2025.8.5 Fixed in 2025.10.2, 2025.8.5 Patch available CNA
goauthentik.io (Go) Vendor— Affected before 0.0.0-20251119135424-6672e6aaa41e Fixed in 0.0.0-20251119135424-6672e6aaa41e Patch available GHSA-ch7q-53v8-73pc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:goauthentik:authentik::::::::	2025.8.0 to before 2025.8.5; 2025.10.0 to before 2025.10.2	Vulnerable	goauthentik

cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* Versions 2025.8.0 to before 2025.8.5; 2025.10.0 to before 2025.10.2 Vulnerable ·goauthentik

Remediation

Fix · CNA authentik (goauthentik) Fixed in 2025.10.2, 2025.8.5
Fix · GHSA-ch7q-53v8-73pc goauthentik.io (Go) Fixed in 0.0.0-20251119135424-6672e6aaa41e Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64708
2026-10-03 Alias added: GHSA-ch7q-53v8-73pc

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-64708

Other 1

https://github.com/goauthentik/authentik

TI-2026-36603 authentik: SourceStage bypass via empty POST CVSS 3.1CRITICAL 9.8
TI-2022-07608 authentik vulnerable to Improper Authentication via invitation URL token reuse CVSS 3.1CRITICAL 9.4
TI-2026-36598 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API CVSS 3.1HIGH 8.8
TI-2022-22816 authentik allows existing authenticated users to create arbitrary accounts CVSS 3.1MEDIUM 6.4
TI-2024-25628 Insufficient access control for OAuth2 Device Code flow in authentik CVSS 3.1CRITICAL 9.8
TI-2023-24876 authentik potential installation takeover when default admin user is deleted CVSS 3.1CRITICAL 9.8

See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences