Vulnerability · Published May 6, 2025 · Assigned by GitHub_M

CVE-2025-46815ZITADEL Allows IdP Intent Token Reuse

High 8.0

In plain English

A high-severity session fixation in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 59.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/zitadel/zitadel	3.0.0	GHSA-g4r8-mp7g-85fq
Go	github.com/zitadel/zitadel	2.70.10	GHSA-g4r8-mp7g-85fq
Go	github.com/zitadel/zitadel	2.71.9	GHSA-g4r8-mp7g-85fq
Go	github.com/zitadel/zitadel	no fix listed	GO-2025-3671

Affected products (as reported)

Vendor	Product	Versions
zitadel	zitadel	>= 3.0.0-rc.1, < 3.0.0< 2.70.10>= 2.71.0, < 2.71.9

Weakness: CWE-613, CWE-294, CWE-384 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq x_refsource_CONFIRM
https://github.com/zitadel/zitadel/commit/b1e60e7398d677f08b06fd7715227f70b7ca1162 x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v2.70.10 x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v2.71.9 x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v3.0.0 x_refsource_MISC