CVE-2025-53895

ZITADEL has broken authN and authZ in session API and resulting session tokens

State: Published
Severity: 7.7 High
Published: Jul 15, 2025
Updated: Jul 15, 2025
Reserved: Jul 11, 2025

Description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-863 Incorrect Authorization
CWE-384 Session Fixation

Affected Products

Product	Versions
zitadelzitadel	= 4.0.0-rc.1Affected >= 3.0.0, < 3.3.1Affected >= 2.53.0, < 2.70.14Affected >= 2.71.0, < 2.71.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.