medium5.5
CVE-2025-59036
Infrahub: Deleted and expired API tokens can still authenticate
Impact
### Impact A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. ### Patches This issue is fixed in versions `1.3.9` and `1.4.5` ### Workarounds Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | infrahub-server | < 1.3.9 | 1.3.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/opsmill/infrahub/security/advisories/GHSA-v2p7-4pv4-3wwh
- https://github.com/advisories/GHSA-v2p7-4pv4-3wwh
- https://nvd.nist.gov/vuln/detail/CVE-2025-59036
- https://github.com/opsmill/infrahub/commit/215185f217e2f754f7c0a0aa4b77e11079a063a1
- https://github.com/opsmill/infrahub/commit/61b49a4a9e988f10c3a44f0e86ef97f344a1e228
- https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.3.9
- https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.4.5