CVE-2025-53895

Description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

Reserved 2025-07-11 | Published 2025-07-15 | Updated 2025-07-15 | Assigner GitHub_M

Problem types

CWE-863: Incorrect Authorization

CWE-384: Session Fixation

Product status

= 4.0.0-rc.1
affected

>= 3.0.0, < 3.3.1
affected

>= 2.53.0, < 2.70.14
affected

>= 2.71.0, < 2.71.13
affected

References

github.com/...itadel/security/advisories/GHSA-6c5p-6www-pcmr

github.com/zitadel/zitadel/releases/tag/v2.70.14

github.com/zitadel/zitadel/releases/tag/v2.71.13

github.com/zitadel/zitadel/releases/tag/v3.3.2

github.com/zitadel/zitadel/releases/tag/v4.0.0-rc.2

cve.org (CVE-2025-53895)

nvd.nist.gov (CVE-2025-53895)

Download JSON