A vulnerability in goauthentik.io's authentik component causes invitation expiry to be delayed by at least 5 minutes. Invitations remain valid until a background cleanup task runs, which is scheduled every 5 minutes, potentially allowing expired invitations to be used longer than intended. This delay can be extended if there is a backlog of tasks. Fixed versions are available, and a workaround policy can be implemented to enforce invitation validity checks.