CVE-2025-53895: ZITADEL has broken authN and authZ in session API and resulting session tokens
ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to 2.53.0 are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53895?
CVE-2025-53895 has a high severity rating due to its potential impact on session security.
How do I fix CVE-2025-53895?
To resolve CVE-2025-53895, upgrade ZITADEL to version 4.0.0-rc.2, 3.3.2, 2.71.13, or 2.70.14.
What is the impact of CVE-2025-53895?
CVE-2025-53895 allows an authenticated user to modify any session if they are aware of the session ID, compromising user sessions.
Which versions of ZITADEL are affected by CVE-2025-53895?
ZITADEL versions starting from 2.53.0 up to but not including 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 are affected by CVE-2025-53895.
Is authentication required to exploit CVE-2025-53895?
Yes, only authenticated users can exploit CVE-2025-53895 by updating sessions if they possess the session ID.