UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53895

Broken authN and authZ in session API and resulting session tokens

Severity
High 7.7
Published
15 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.70.14, 2.71.13, 3.3.1
Also known as
GHSA-6c5p-6www-pcmr
Sources
NVD, Project advisories (GitHub)

Description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access…

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • From 2.53.0 before 2.70.14
  • From 2.71.0 before 2.71.13
  • From 3.0.0 before 3.3.1
  • Version 4.0.0-rc1
ZITADELServers and applications · github:zitadel/zitadel
  • From 2.71.0 before 2.71.13
  • From 3.0.0 before 3.3.1
  • Version 4.0.0-rc.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53895
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53895
  • GitHub Advisory Database https://github.com/advisories/GHSA-6c5p-6www-pcmr
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-6c5p-6www-pcmr