Authentication Flaw in Authentik Open-Source Identity Provider

CVE-2025-64708

What is CVE-2025-64708?

The Authentik open-source Identity Provider has a vulnerability related to its invitation management system. In versions before 2025.8.5 and 2025.10.2, invitations can be accepted even if they have expired, as the cleanup process for expired invitations is delayed by background tasks. This could lead to a security issue, particularly when a large backlog of tasks exists, potentially extending the time for cleanup beyond five minutes. To mitigate this issue, upgrading to the latest versions is advised, and implementing a policy to validate invitations during the invitation flow can serve as a temporary workaround.

References