CVE-2025-64708

Go/goauthentik.io CVE-2025-64708: medium 5.8, EPSS 0.27%

authentik's invitation expiry is delayed by at least 5 minutes

Action: Upgrade goauthentik.io to 0.0.0-20251119135424-6672e6aaa41e or later.

go get goauthentik.io@v0.0.0-20251119135424-6672e6aaa41e

Affected

Fixed versions

Sources

• osv: GHSA-ch7q-53v8-73pc
• https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc
• https://nvd.nist.gov/vuln/detail/CVE-2025-64708
• https://github.com/goauthentik/authentik/commit/6672e6aaa41e0f2c9bfb1e4d8b51cf114969e830
• https://github.com/goauthentik/authentik

CVE-2025-64708 · published 2025-11-19T18:47:07Z · modified 2026-04-17T04:57:11.733595493Z · JSON

Go/goauthentik.io CVE-2025-64708: unknown, EPSS 0.27%

authentik's invitation expiry is delayed by at least 5 minutes in goauthentik.io

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2025-4136
• https://github.com/goauthentik/authentik/security/advisories/GHSA-ch7q-53v8-73pc
• https://nvd.nist.gov/vuln/detail/CVE-2025-64708
• https://github.com/goauthentik/authentik/commit/6672e6aaa41e0f2c9bfb1e4d8b51cf114969e830

CVE-2025-64708 · published 2025-12-15T20:33:49Z · modified 2026-04-17T04:57:11.733595493Z · JSON