Invitation Link doesn’t expire after used .

In this write-up, I'll share how I discovered a replayable Invitation Link token vulnerability, which allowed reusing the same Invitation Link multiple times .

Vulnerability Details :

When I manually test applications, I usually start by checking for common security issues like Privilege Escalation or IDORs. However, after finding no vulnerabilities in those areas, I decided to analyze the application's Invitation System.

Normally, when an admin invites a user, the invitation link should be used only once. After the user joins — or if an admin revokes their access — that link must immediately become invalid.

During my testing, I discovered a business logic flaw: the system fails to invalidate or expire invitation links after they are used. Even if an administrator revokes a user from the workspace, the old invitation link remains fully active. As a result, the removed user can simply reuse the exact same link to re-join the workspace without any administrative approval.

Scenario Example

1. An administrator creates an invitation link and sends it to a new employee. The employee uses the link and successfully joins the workspace.
2. After some time, the employee leaves the company. The admin removes the user from the workspace to revoke their access.
3. The former employee opens the original invitation link again from their email or browser history.
4. The former employee opens the original invitation link again from their email or browser history.
5. Surprisingly, the old link still works. The user re-joins the workspace instantly without any admin approval or security check.

Steps to Reproduce :

1. Generate the Link Log in as an Admin and send a workspace invitation link to a target user.

2. Open the invitation link in a separate browser/incognito window and accept it to join the workspace.

3. Switch back to the Admin account, go to workspace settings, and revoke the user's access.

5. Open the same original invitation link again in a new private window or browser.

6. Notice that the link is still valid and allows the removed user to re-join the workspace without any admin approval !

Repeat the process multiple times — the link remains valid!

Impact

• Revoked users or ex-employees can maintain permanent access to the workspace simply by reusing their old invitation link.
• The vulnerability completely bypasses the admin's decision to remove a user, rendering access control features ineffective.

follow me on linkedin Thank you for taking the time to read!