CVE-2025-53895: ZITADEL has broken authN and authZ in session API and resulting session tokens

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-15 · updated 2026-06-17
Weakness: CWE-384

Description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

Affected products

zitadel: from 2.53.0 before 2.70.14; from 2.71.0 before 2.71.13; from 3.0.0 before 3.3.1; 4.0.0-rc1 — fixed in 2.70.14, 2.71.13, 3.3.1

How to fix

Upgrade to a fixed version: zitadel 2.70.14, 2.71.13, 3.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-53895 or the next vulnerability affects your stack