CVE-2025-59036
Infrahub allows authentication with deleted and expired API tokens
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Infrahub allows authentication with deleted and expired API tokens
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Record
CVE-2025-59036- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-298
- Updated
- 2026-11-02
EUVDEUVD-2025-27503
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Record
EUVD-2025-27503- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v2p7-4pv4-3wwh
Infrahub: Deleted and expired API tokens can still authenticate
Impact
A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully.
Patches
This issue is fixed in versions 1.3.9 and 1.4.5
Workarounds
Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Record
GHSA-v2p7-4pv4-3wwh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-298
- Updated
- 2026-11-02
NVD
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Record
CVE-2025-59036- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-298
- Updated
- 2026-11-02
OSV
Infrahub allows authentication with deleted and expired API tokens
Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Record
CVE-2025-59036- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-298
- Updated
- 2026-11-02
OSVGHSA-v2p7-4pv4-3wwh
Infrahub: Deleted and expired API tokens can still authenticate
Impact
A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully.
Patches
This issue is fixed in versions 1.3.9 and 1.4.5
Workarounds
Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Record
GHSA-v2p7-4pv4-3wwh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-298
- Updated
- 2026-11-02
OSVPYSEC-2026-1463
Infrahub: Deleted and expired API tokens can still authenticate
Impact
A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully.
Patches
This issue is fixed in versions 1.3.9 and 1.4.5
Workarounds
Users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.
- Record
PYSEC-2026-1463- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
infrahub-serverPyPI |
before 1.3.9 | 1.3.9 |
infrahub-serverPyPI |
1.4.0 up to 1.4.5 | 1.4.5 |
infrahub-serverPyPI |
before 1.3.9, plus listed versions 1.0.11.0.101.0.81.0.91.1.0 Show 42 moreShow less1.1.0b21.1.11.1.101.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.0b11.2.0rc01.2.11.2.101.2.111.2.121.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.2.9rc01.3.01.3.0a01.3.0b11.3.0b21.3.0b31.3.0b51.3.0b61.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.8 |
1.3.9 |
infrahub-serverPyPI |
1.4.0 up to 1.4.5, plus listed versions 1.4.11.4.21.4.31.4.4 |
1.4.5 |
infrahub-serverPyPI |
before 1.3.9, 1.4.0 up to 1.4.5, plus listed versions 1.0.11.0.101.0.81.0.91.1.0 Show 45 moreShow less1.1.0b21.1.11.1.101.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.0b11.2.0rc01.2.11.2.101.2.111.2.121.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.2.9rc01.3.01.3.0a01.3.0b11.3.0b21.3.0b31.3.0b51.3.0b61.3.11.3.21.3.31.3.41.3.51.3.61.3.71.3.81.4.11.4.21.4.3 |
1.3.91.4.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59036 is a medium vulnerability (CVSS 5.5) in Opsmill Infrahub, published September 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in infrahub-server 1.3.9.
References
github.com/opsmill/infrahub/security/advisories/GHSA-v2p7-4pv4-3wwh
nvd.nist.gov/vuln/detail/CVE-2025-59036
Left out here: 1 version. The JSON record has them.