CVE-2025-53895CWE-384CWE-863

ZITADEL has broken authN and authZ in session API and resulting session tokens

High · published July 15, 2025

CVSS v4.0
7.7
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00413 · 34.5th percentile
Weaknesses
CWE-384 · Session Fixation; CWE-863 · Incorrect Authorization
Published
2025-07-15T16:39Z
EPSS history
Timeline
  • 15 JUL 16:39Z
    ZITADEL has broken authN and authZ in session API and resulting session tokens
    cvelistv5