PT-2025-47495 · Authentik · Authentik

Published 2025-11-19 · Updated 2026-04-16 · CVE-2025-64708

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.8.5 authentik versions prior to 2025.10.2

Description authentik, an open-source Identity Provider, had a flaw where invitations remained valid even after expiration. This relied on background tasks to remove expired invitations, with a potential delay of up to 5 minutes, or longer with a large backlog of tasks. The issue stemmed from not validating invitation validity during the invitation process. A workaround involved creating a policy to explicitly check invitation validity and denying access if expired.

Recommendations Update to authentik version 2025.8.5 or later. Update to authentik version 2025.10.2 or later. Implement a policy that explicitly checks whether the invitation is still valid and denies access if the invitation is not valid.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BIT-AUTHENTIK-2025-64708

CVE-2025-64708

GHSA-CH7Q-53V8-73PC

GO-2025-4136

SUSE-SU-2026:0037-1

Affected Products

Authentik

References · 92

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64708.json · Exploit
• https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc · Vendor Advisory
• https://github.com/goauthentik/authentik/commit/6672e6aaa41e0f2c9bfb1e4d8b51cf114969e830 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64708 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ch7q-53v8-73pc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64708 · Security Note
• https://osv.dev/vulnerability/BIT-authentik-2025-64708 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4136 · Vendor Advisory
• https://github.com/goauthentik/authentik · Note
• https://t.me/cveNotify/143500 · Telegram Post
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2017-18888 · Note
• https://suse.com/security/cve/CVE-2025-13352 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note