Listen to this Post
How the CVE Works
This vulnerability stems from a flawed invitation expiry mechanism in authentik. The system does not perform an immediate, real-time check for invitation validity upon redemption. Instead, it relies on a periodic background task that runs every 5 minutes to clean up and invalidate expired invitations. This creates a critical time window where an invitation, though technically expired, remains fully functional. The delay is at least 5 minutes under normal system load but can extend significantly longer if the task processing backlog is large, leaving access controls improperly enforced for an unpredictable period.
Platform: Authentik
Version: < 2025.8.5
Vulnerability: Delayed Invitation Expiry
Severity: Moderate
date: 2024-11-19
Prediction: Patch 2025.8.5
What Undercode Say:
Analytics
Check for running authentik worker processes ps aux | grep -i authentik | grep worker Monitor the task queue backlog in Redis (if used) redis-cli LLEN authentik:scheduled_tasks Inspect logs for the cleanup task execution grep "clean_expired_models" /var/log/authentik.log
How Exploit:
An attacker can use a known invitation link after its intended expiry time. The exploit requires no special privileges or techniques; the user simply clicks the link or submits the invitation code. The success of the exploit is dependent on the backend task scheduler, not any action by the attacker, making it highly reliable within the delay window.
Protection from this CVE
1. Upgrade to authentik 2025.8.5 or 2025.10.2.
2. Implement the workaround policy.
3. Manually trigger cleanup tasks.
4. Monitor worker queue backlog.
Impact:
Unauthorized system access, privilege escalation, policy bypass, and data exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
