GitHub Advisoryadvisory · PyPI

GHSA-v2p7-4pv4-3wwh Infrahub: Deleted and expired API tokens can still authenticate

MEDIUM Published 2025-09-10 Modified 2025-09-10 Official page ↗
Aliases
CVE-2025-59036
Ecosystem
PyPI
Packages
infrahub-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-298
Reviewed
2025-09-10

Affected packages

• PyPI infrahub-server: < 1.3.9 → fixed in 1.3.9 • PyPI infrahub-server: >= 1.4.0, < 1.4.5 → fixed in 1.4.5

Description

Impact A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. Patches This issue is fixed in versions `1.3.9` and `1.4.5` Workarounds Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

Related

Alias · CVE (1)

  • CVE-2025-59036 Infrahub offers a central hub to manage data, templates, and playbooks. vulnerability

Weakness · CWE (1)

  • CWE-298 Improper Validation of Certificate Expiration weakness

References