CVE-2025-31123: Zitadel Auth Bypass Vulnerability

CVE-2025-31123 Overview

CVE-2025-31123 affects Zitadel, an open-source identity infrastructure platform. The vulnerability allows expired JSON Web Token (JWT) keys to be used for obtaining valid access tokens through the Authorization Grant flow. Zitadel fails to verify the expiration field on JWT keys used for Authorization Grants, although JWT Profile for OAuth 2.0 Client Authentication on Token and Introspection endpoints correctly rejects expired keys. An attacker possessing a previously valid but expired key can still request and receive valid access tokens, undermining the key rotation and revocation model. The issue is tracked under [CWE-324] (Use of a Key Past its Expiration Date) and is fixed in versions 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

Critical Impact
An attacker holding an expired JWT key can obtain valid OAuth access tokens, bypassing key expiration controls and gaining unauthorized access to protected resources.

Affected Products

Zitadel versions prior to 2.63.9 (2.63.x branch)
Zitadel versions prior to 2.64.6, 2.65.7, 2.66.16, 2.67.13, 2.68.9, 2.69.9, 2.70.8
Zitadel versions prior to 2.71.6 (latest fixed branch)

Discovery Timeline

2025-03-31 - CVE-2025-31123 published to NVD
2025-08-26 - Last updated in NVD database

Technical Details for CVE-2025-31123

Vulnerability Analysis

The flaw resides in Zitadel's handling of JWT-based Authorization Grants. When a machine user authenticates using a JWT signed by a configured key, Zitadel looks up the corresponding key record and validates the signature. However, the database query that retrieves the key record omits any check against the stored expiration timestamp. As a result, an expired key remains usable for issuing access tokens through the Authorization Grant endpoint. The same flow on the OAuth 2.0 Token and Introspection endpoints applies the expiration check correctly, which is why those endpoints are not impacted. The discrepancy creates an authentication mechanism that silently honors revoked-by-time credentials, weakening the security guarantees of key rotation.

Root Cause

The root cause is a missing SQL predicate in internal/query/authn_key_user.sql. The query joining projections.users14 and projections.users14_machines against the key table did not filter on k.expiration > current_timestamp. Without that constraint, the application treated lapsed keys as valid credentials. This is a classic [CWE-324] condition where the system uses a cryptographic key after its declared lifetime.

Attack Vector

An attacker who has obtained a JWT key that was once valid, such as a leaked, archived, or rotated-out service account key, can craft a JWT assertion and submit it to the Authorization Grant endpoint. Because the network-reachable endpoint accepts the expired key, the attacker receives an access token with the privileges originally granted to that machine user. Exploitation requires high privileges in the sense that the attacker must possess key material, but no user interaction is needed.

// Security patch in internal/query/authn_key_user.sql
// The fix adds an expiration predicate to the key lookup query
 join projections.users14 u
 	on k.instance_id = u.instance_id
 	and k.identifier = u.id
-join projections.users14_machines m 
+join projections.users14_machines m
 	on u.instance_id = m.instance_id
 	and u.id = m.user_id
 where k.instance_id = $1
 	and k.id = $2
-	and u.id = $3;
+	and u.id = $3
+    and k.expiration > current_timestamp;

Source: Zitadel commit 315503b

Detection Methods for CVE-2025-31123

Indicators of Compromise

Successful Authorization Grant token issuance events where the underlying JWT key's expiration timestamp is in the past.
Access token usage by machine users tied to keys that were marked expired or rotated out of active use.
Spikes in Authorization Grant requests originating from machine users whose keys are no longer current.

Detection Strategies

Correlate Zitadel audit logs of Authorization Grant issuance with the key store to flag any grant tied to an expired key_id.
Compare access token issuance timestamps against the expiration values of the JWT keys recorded in projections.authn_keys.
Alert on machine user activity associated with keys that should have been retired per the key rotation policy.

Monitoring Recommendations

Enable verbose OIDC and OAuth event logging on Zitadel and forward to a centralized log platform for retention and correlation.
Track machine user activity baselines and alert on anomalous Authorization Grant volume or new source IP ranges.
Periodically reconcile the active key inventory against issued tokens to identify use of past-expiration credentials.

How to Mitigate CVE-2025-31123

Immediate Actions Required

Upgrade Zitadel to a fixed release on your current branch: 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, or 2.63.9.
Rotate all machine user JWT keys, especially any keys that were previously expired but still present in the system.
Audit recent Authorization Grant activity and revoke any tokens issued via expired keys.

Patch Information

The fix is published in the GitHub Security Advisory GHSA-h3q7-347g-qwhf and implemented in commit 315503b. Patched binaries are available from the corresponding GitHub releases, including v2.71.6 and earlier supported branches down to v2.63.9.

Workarounds

Delete expired JWT keys from machine user accounts so they cannot be referenced by the Authorization Grant endpoint.
Shorten key lifetimes and enforce strict offboarding of rotated keys until the upgrade is applied.
Restrict network access to the Zitadel Authorization Grant endpoint to trusted client networks where feasible.

bash

# Verify the installed Zitadel version and upgrade via Helm
kubectl exec -n zitadel deploy/zitadel -- zitadel --version

# Example: upgrade Zitadel via Helm to a fixed release
helm repo update
helm upgrade zitadel zitadel/zitadel \
  --namespace zitadel \
  --version <chart-version-pinning-2.71.6-or-later>