Vulnerability Description
ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zitadel | Zitadel | >= 2.53.0, < 2.70.14 |
Related Weaknesses (CWE)
References
- https://github.com/zitadel/zitadel/releases/tag/v2.70.14Release Notes
- https://github.com/zitadel/zitadel/releases/tag/v2.71.13Release Notes
- https://github.com/zitadel/zitadel/releases/tag/v3.3.2Release Notes
- https://github.com/zitadel/zitadel/releases/tag/v4.0.0-rc.2Release Notes
- https://github.com/zitadel/zitadel/security/advisories/GHSA-6c5p-6www-pcmrVendor Advisory
FAQ
What is CVE-2025-53895?
CVE-2025-53895 is a vulnerability with a CVSS score of 8.8 (HIGH). ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows...
How severe is CVE-2025-53895?
CVE-2025-53895 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-53895?
Check the references section above for vendor advisories and patch information. Affected products include: Zitadel Zitadel.