GHSA-ch7q-53v8-73pc

Suggest an improvement
Source
https://github.com/advisories/GHSA-ch7q-53v8-73pc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-ch7q-53v8-73pc/GHSA-ch7q-53v8-73pc.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-ch7q-53v8-73pc
Aliases
Published
2025-11-19T18:47:07Z
Modified
2025-11-19T19:29:58.841021Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
authentik's invitation expiry is delayed by at least 5 minutes
Details

Summary

In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer.

Patches

authentik 2025.8.5 and 2025.10.2 fix this issue; for other versions the workaround below can be used.

Workarounds

Users can create a policy that explicitly checks whether the invitation is still valid, and then bind it to the invitation stage on your invitation flow, and deny access if the invitation is not valid.

return not context['flow_plan'].context['invitation'].is_expired

For more information

If users have any questions or comments about this advisory:

Database specific 
{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-613"
    ],
    "nvd_published_at": "2025-11-19T17:15:52Z",
    "github_reviewed_at": "2025-11-19T18:47:07Z",
    "github_reviewed": true
}
References

Affected packages

Go / goauthentik.io

Package

Name
goauthentik.io
View open source insights on deps.dev
Purl
pkg:golang/goauthentik.io

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.0.0-20251119135424-6672e6aaa41e