CVE-2025-64708: 
NixOS vulnerability analysis and mitigation

CVE-2025-64708 is a vulnerability in authentik, an open-source Identity Provider, where expired invitations remain valid due to delayed background cleanup tasks. The flaw affects authentik versions 2025.8.0 through 2025.8.4 and 2025.10.0 through 2025.10.1. It was disclosed on November 19, 2025, by researcher melizeche. The CVSS v3.1 base score is 5.3 (Medium) per NVD, or 5.8 (Medium) per the GitHub CNA with a changed scope (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-613 (Insufficient Session Expiration): authentik's invitation stage retrieved invitations using Invitation.objects.filter(pk=token).first() without checking expiry status, relying solely on a background cleanup task scheduled every 5 minutes to remove expired invitations (GitHub Security Advisory). The fix, applied in commit 6672e6a, changes the query to Invitation.filter_not_expired(pk=token).first(), enforcing expiry validation at the point of use (Patch Commit). Exploitation requires no authentication or privileges — an attacker only needs a previously issued (now expired) invitation token and network access to the authentik instance. The exploitation window is at least 5 minutes after invitation expiry under normal conditions, but can be significantly longer if the background task queue is backlogged.

Successful exploitation allows an unauthenticated attacker to use an expired invitation token to gain access to resources or complete registration flows that should no longer be permitted. The primary impact is unauthorized access to systems protected by authentik's invitation-based enrollment, resulting in a low confidentiality impact (access to resources gated by the invitation flow). Integrity and availability are not directly affected, and there is no evidence of lateral movement potential beyond the scope of the invitation flow itself (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is straightforward for anyone who possesses a recently expired invitation token, requiring no special tools or privileges.

1. Obtain an expired invitation token: Acquire an authentik invitation token that has recently passed its expiration time — this could be a token previously shared with the attacker, intercepted, or obtained through social engineering.
2. Identify the target authentik instance: Locate the authentik deployment's invitation flow URL (e.g., https://<authentik-host>/if/flow/<invitation-flow-slug>/).
3. Submit the expired token: Access the invitation flow URL and supply the expired token via the query string parameter (e.g., ?query=<token>), before the background cleanup task has run.
4. Complete the flow: If the cleanup task has not yet removed the expired invitation (within the ~5-minute window, or longer under backlog conditions), authentik will treat the invitation as valid and allow the attacker to proceed through the enrollment or access flow (GitHub Security Advisory, Patch Commit).

• Logs: authentik access logs showing successful completion of invitation flows using tokens with expiry timestamps in the past; look for flow-executor requests with invitation token query parameters that correspond to invitations marked as expired in the database.
• Database: Presence of completed enrollment or access events linked to invitation records whose expires field predates the event timestamp by more than a few seconds.
• Network: HTTP GET requests to authentik flow executor endpoints (e.g., /api/v3/flows/executor/<flow-slug>/) with query parameters containing invitation UUIDs, particularly from unexpected source IPs or at unusual times.

Upgrade to authentik version 2025.8.5 or 2025.10.2, which fix the issue by enforcing expiry validation at invitation lookup time (GitHub Security Advisory). For deployments that cannot immediately upgrade, create a policy bound to the invitation stage that explicitly checks invitation validity and denies access if expired, using the following Python expression:

return not context['flow_plan'].context['invitation'].is_expired

Additionally, minimizing background task queue backlogs will reduce the exploitation window on unpatched systems (Github Advisory).