CVE-2025-59036

CVE-2025-59036 affects Infrahub versions prior to 1.3.9 and 1.4.5, where a flaw in authentication logic allows previously deleted or expired API tokens to remain valid for active user accounts. This medium severity vulnerability (CVSS 5.5) has a network attack vector and low attack complexity, potentially leading to limited confidentiality, integrity, and availability impacts if an attacker gains access to such a token. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.