Vulnerability Summary: Invitation expiry is delayed by at least 5 minutes. Affected Versions: <= 2025.10.1, <= 2025.8.4 Patched Versions: 2025.10.2, 2025.8.5 Severity: Moderate (5.8/10) CVE ID: CVE-2025-64708 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: None - Availability: None Description: Invitations were considered valid even if expired, relying on background tasks for cleanup that might take up to 5 minutes, potentially longer with a backlog. Patches: authentik 2025.8.5 and 2025.10.2 Workaround: Create a policy checking invitation validity and deny access if expired. For More Information: Contact security@goauthentik.io.