---
id: CVE-2025-59036
aliases:
  - GHSA-v2p7-4pv4-3wwh
  - PYSEC-2026-1463
title: 'Infrahub: Deleted and expired API tokens can still authenticate'
summary: 'Infrahub: Deleted and expired API tokens can still authenticate'
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L'
vendor: infrahub-server
product: infrahub-server
ecosystem: pip
affected:
  - infrahub-server < 1.3.9
  - 'infrahub-server >= 1.4.0, < 1.4.5'
patched:
  - infrahub-server 1.3.9
  - infrahub-server 1.4.5
published: '2025-09-10'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-v2p7-4pv4-3wwh'
references:
  - url: >-
      https://github.com/opsmill/infrahub/security/advisories/GHSA-v2p7-4pv4-3wwh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59036'
  - url: >-
      https://github.com/opsmill/infrahub/commit/215185f217e2f754f7c0a0aa4b77e11079a063a1
  - url: >-
      https://github.com/opsmill/infrahub/commit/61b49a4a9e988f10c3a44f0e86ef97f344a1e228
  - url: 'https://github.com/opsmill/infrahub'
  - url: 'https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.3.9'
  - url: 'https://github.com/opsmill/infrahub/releases/tag/infrahub-v1.4.5'
tags:
  - osv
  - pip
epss: 0.0019
epssPercentile: 0.07679
ingestedAt: '2026-07-08T18:25:53.047Z'
---

## Overview

### Impact
A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully.

### Patches
This issue is fixed in versions `1.3.9` and `1.4.5`

### Workarounds
Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

## Affected packages

- `infrahub-server < 1.3.9`
- `infrahub-server >= 1.4.0, < 1.4.5`

## Remediation

Upgrade to a patched release:

- `infrahub-server 1.3.9`
- `infrahub-server 1.4.5`