{"id":"CVE-2025-59036","aliases":["GHSA-v2p7-4pv4-3wwh","PYSEC-2026-1463"],"title":"Infrahub: Deleted and expired API tokens can still authenticate","summary":"Infrahub: Deleted and expired API tokens can still authenticate","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","vendor":"infrahub-server","product":"infrahub-server","ecosystem":"pip","affected":["infrahub-server < 1.3.9","infrahub-server >= 1.4.0, < 1.4.5"],"patched":["infrahub-server 1.3.9","infrahub-server 1.4.5"],"published":"2025-09-10","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-v2p7-4pv4-3wwh","references":[{"url":"https://github.com/opsmill/infrahub/security/advisories/GHSA-v2p7-4pv4-3wwh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59036"},{"url":"https://github.com/opsmill/infrahub/commit/215185f217e2f754f7c0a0aa4b77e11079a063a1"},{"url":"https://github.com/opsmill/infrahub/commit/61b49a4a9e988f10c3a44f0e86ef97f344a1e228"},{"url":"https://github.com/opsmill/infrahub"},{"url":"https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.3.9"},{"url":"https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.4.5"}],"tags":["osv","pip"],"epss":0.0019,"epssPercentile":0.07679,"ingestedAt":"2026-07-08T18:25:53.047Z","slug":"CVE-2025-59036","body":"## Overview\n\n### Impact\nA bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully.\n\n### Patches\nThis issue is fixed in versions `1.3.9` and `1.4.5`\n\n### Workarounds\nUsers can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.\n\n## Affected packages\n\n- `infrahub-server < 1.3.9`\n- `infrahub-server >= 1.4.0, < 1.4.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `infrahub-server 1.3.9`\n- `infrahub-server 1.4.5`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}