GHSA-v2p7-4pv4-3wwhMediumCVSS 5.5

Infrahub: Deleted and expired API tokens can still authenticate

Published
September 10, 2025
Last Modified
September 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-59036 →

📋 Description

Impact

A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully.

Patches

This issue is fixed in versions 1.3.9 and 1.4.5

Workarounds

Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

🎯 Affected products2

  • pip/infrahub-server:< 1.3.9
  • pip/infrahub-server:>= 1.4.0, < 1.4.5

🔗 References (7)