CVE-2025-59036CWE-298

Infrahub allows authentication with deleted and expired API tokens

Medium · published September 9, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.7th percentile
Weakness
CWE-298 · Improper Validation of Certificate Expiration
Published
2025-09-09T22:06Z
EPSS history
Timeline
  • 09 SEP 22:06Z
    Infrahub allows authentication with deleted and expired API tokens
    cvelistv5