CVE-2025-53895

high

Description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

References

https://github.com/zitadel/zitadel/security/advisories/GHSA-6c5p-6www-pcmr

https://github.com/zitadel/zitadel/releases/tag/v4.0.0-rc.2

https://github.com/zitadel/zitadel/releases/tag/v3.3.2

https://github.com/zitadel/zitadel/releases/tag/v2.71.13

https://github.com/zitadel/zitadel/releases/tag/v2.70.14

Details

Source: Mitre, NVD

Published: 2025-07-15

Updated: 2025-07-15

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 7.7

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00041