# CVE-2025-64708: GO-2025-4136 - authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io

Source: https://junglewise.ai/threats/cve-2025-64708-authentik-s-invitation-expiry-is-delayed-by-at-least-5-minutes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-19  
License: CC BY 4.0 with a link back

CVE-2025-64708 · Severity: medium · CVSS 5.8 · Published 2025-11-19

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer. authentik versions 2025.8.5 and 2025.10.2 fix this issue. A workaround involves creating a policy that explicitly checks whether the invitation is still valid, and then bind it to the invitation stage on the invitation flow, and denying access if the invitation is not valid.

Technologies: [goauthentik.io (Go)](https://junglewise.ai/threats/technologies/goauthentik-io), [Goauthentik Authentik](https://junglewise.ai/threats/technologies/authentik). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Goauthentik](https://junglewise.ai/threats/vendors/goauthentik).

## Quick answers

**Is CVE-2025-64708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64708 being exploited in the wild.

**How severe is CVE-2025-64708?** Medium severity, with a CVSS score of 5.8, published 19 November 2025.

**Which products and versions are affected?** goauthentik.io (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20251119135424-6672e6aaa41e.

**Is there a fix for CVE-2025-64708?** Yes. goauthentik.io (Go): upgrade to 0.0.0-20251119135424-6672e6aaa41e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-64708?** Check whether you run goauthentik.io (Go) or Goauthentik Authentik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- goauthentik.io (Go): upgrade to 0.0.0-20251119135424-6672e6aaa41e or later

  ```sh
  go get goauthentik.io@v0.0.0-20251119135424-6672e6aaa41e
  ```


## Affected products

- goauthentik.io (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.0.0-20251119135424-6672e6aaa41e
- Goauthentik Authentik

## Identifiers

- CVE-2025-64708
- GHSA-ch7q-53v8-73pc
- GO-2025-4136

## Related threats

- [goauthentik authentik authentication bypass in Source stage](https://junglewise.ai/threats/cve-2026-49448-goauthentik-authentik-authentication-bypass-in-source-stage)
- [goauthentik authentik improper authentication in Source Connections](https://junglewise.ai/threats/cve-2026-49443-goauthentik-authentik-improper-authentication-in-source)
- [goauthentik authentik XML Signature Wrapping in SAML Source ACS](https://junglewise.ai/threats/cve-2026-47201-goauthentik-authentik-xml-signature-wrapping-in-saml-source-acs)
- [authentik reflected XSS in Simple Flow Executor AutosubmitStage](https://junglewise.ai/threats/cve-2026-42849-authentik-reflected-xss-in-simple-flow-executor-autosubmitstage)
- [authentik WS-Federation origin bypass in wreply parameter](https://junglewise.ai/threats/cve-2026-41569-authentik-ws-federation-origin-bypass-in-wreply-parameter)