CVE-2025-59036

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-298

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-590378.6DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was comp CVE-2025-590388.6Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been bri CVE-2025-590399.3Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected CVE-2025-59048.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function set CVE-2025-590404.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify CVE-2025-590419.8Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to versio CVE-2025-590427.0PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to `sys.path`CVE-2025-590437.5OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use CVE-2025-590444.4Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups f CVE-2025-590457.1Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exist CVE-2025-590469.8The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts f CVE-2025-590472.7matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalize