Session API Vulnerability in ZITADEL Identity Infrastructure Software
CVE-2025-46815
8HIGH
What is CVE-2025-46815?
A security flaw in the ZITADEL identity infrastructure software allows attackers to exploit the Session API. This vulnerability enables unauthorized retrieval of user sessions through repeated use of IdP intents. The compromised tokens and IDs can be used for unauthorized user authentication, posing a significant risk to user data and session integrity. Users are advised to upgrade to versions 2.70.10, 2.71.9, or 3.0.0, where this issue has been remedied. Implementing multi-factor authentication (MFA) is recommended to mitigate the risk further.
Affected Version(s)
zitadel >= 3.0.0-rc.1, < 3.0.0 < 3.0.0-rc.1, 3.0.0
zitadel < 2.70.10 < 2.70.10
zitadel >= 2.71.0, < 2.71.9 < 2.71.0, 2.71.9