Session API Vulnerability in ZITADEL Identity Infrastructure Software
CVE-2025-46815
8HIGH
Summary
A security flaw in the ZITADEL identity infrastructure software allows attackers to exploit the Session API. This vulnerability enables unauthorized retrieval of user sessions through repeated use of IdP intents. The compromised tokens and IDs can be used for unauthorized user authentication, posing a significant risk to user data and session integrity. Users are advised to upgrade to versions 2.70.10, 2.71.9, or 3.0.0, where this issue has been remedied. Implementing multi-factor authentication (MFA) is recommended to mitigate the risk further.
Affected Version(s)
zitadel >= 3.0.0-rc.1, < 3.0.0 < 3.0.0-rc.1, 3.0.0
zitadel < 2.70.10 < 2.70.10
zitadel >= 2.71.0, < 2.71.9 < 2.71.0, 2.71.9
References
CVSS V3.1
Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved