PT-2025-29579 · Zitadel · Zitadel

Livio + 1 · Published 2025-07-15 · Updated 2025-07-15 · CVE-2025-53895

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.0.0-rc.2 ZITADEL versions prior to 3.3.2 ZITADEL versions prior to 2.71.13 ZITADEL versions prior to 2.70.14 ZITADEL versions 2.53.0 through 3.3.1

Description ZITADEL’s session management API has a flaw where an authenticated user can update a session knowing only its ID, due to a missing permission check. This enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources.

Recommendations Update ZITADEL to version 4.0.0-rc.2 or later. Update ZITADEL to version 3.3.2 or later. Update ZITADEL to version 2.71.13 or later. Update ZITADEL to version 2.70.14 or later.

Exploit

Fix

Incorrect Authorization

Session Fixation

Weakness Enumeration

CWE-863

CWE-384

Related Identifiers

CVE-2025-53895

GHSA-6C5P-6WWW-PCMR

Affected Products

Zitadel

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53895.json · Exploit
• https://github.com/zitadel/zitadel/security/advisories/GHSA-6c5p-6www-pcmr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53895 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53895 · Vendor Advisory
• https://github.com/zitadel/zitadel/releases/tag/v2.70.14 · Note
• https://github.com/zitadel/zitadel/releases/tag/v3.3.2 · Note
• https://github.com/zitadel/zitadel/releases/tag/v2.71.13 · Note
• https://github.com/zitadel/zitadel/releases/tag/v4.0.0-rc.2 · Note
• https://twitter.com/VulmonFeeds/status/1945236046339297704 · Twitter Post