~ / search / GHSA-v2p7-4pv4-3wwh

GHSA-v2p7-4pv4-3wwh

Infrahub: Deleted and expired API tokens can still authenticate

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-59036

Packages

EcosystemPackageAffectedFixed in
PyPI infrahub-server < 1.3.9 1.3.9
PyPI infrahub-server >= 1.4.0, < 1.4.5 1.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. ### Patches This issue is fixed in versions `1.3.9` and `1.4.5` ### Workarounds Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

References

External links from the advisory. They lead to third-party sites.