Log in Start free

Vulnerability · Published Jul 15, 2025 · Assigned by GitHub_M

CVE-2025-53895ZITADEL has broken authN and authZ in session API and resulting session tokens

High 7.7

In plain English

A high-severity incorrect authorization in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High
Exploit odds (30 days)0.4%top 64.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

Affected products (as reported)

VendorProductVersions
zitadel zitadel = 4.0.0-rc.1>= 3.0.0, < 3.3.1>= 2.53.0, < 2.70.14>= 2.71.0, < 2.71.13

Weakness: CWE-863, CWE-384 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References