CVE-2025-31123: Zitadel Expired JWT Keys Usable for Authorization Grants
Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31123?
CVE-2025-31123 is considered a significant vulnerability due to the potential misuse of expired keys for token retrieval.
How do I fix CVE-2025-31123?
To fix CVE-2025-31123, upgrade to Zitadel version 2.71.6 or later, or ensure you are using a version that has patched this vulnerability.
Which versions of Zitadel are affected by CVE-2025-31123?
Zitadel versions prior to 2.64.6 and between 2.64.6 and 2.71.6 are affected by CVE-2025-31123.
What type of attack is possible due to CVE-2025-31123?
CVE-2025-31123 allows attackers to exploit the software by using expired keys to retrieve unauthorized tokens.
Is there a workaround for CVE-2025-31123?
There is no documented workaround for CVE-2025-31123; upgrading to a patched version is required to mitigate the vulnerability.