CVE-2025-53895 Overview
CVE-2025-53895 affects ZITADEL, an open source identity and access management platform. The vulnerability resides in the session management API and stems from a missing permission check [CWE-384]. Any authenticated user who knows a target session ID can update that session without supplying the session token. This enables session hijacking, allowing attackers to impersonate other users and access protected resources.
The flaw was introduced in version 2.53.0, when session token requirements for updates were relaxed. Versions prior to 2.53.0 are unaffected because they required the session token for any update operation.
Critical Impact
Authenticated attackers can hijack other users' sessions through the ZITADEL session management API and impersonate them across downstream applications.
Affected Products
- ZITADEL versions 2.53.0 through 2.70.13
- ZITADEL versions 2.71.0 through 2.71.12 and 3.0.0 through 3.3.1
- ZITADEL 4.0.0-rc.1
Discovery Timeline
- 2025-07-15 - CVE-2025-53895 published to NVD
- 2025-08-26 - Last updated in NVD database
Technical Details for CVE-2025-53895
Vulnerability Analysis
ZITADEL exposes a session management API that allows clients to create, update, and terminate authentication sessions. Beginning with version 2.53.0, the update endpoint accepted requests from any authenticated caller without verifying that the caller owned the target session or held administrative permissions. The session token, which previously served as the authorization proof for session mutations, was no longer enforced.
An attacker with valid credentials to the ZITADEL instance can therefore mutate any session whose identifier they obtain. Session IDs may be exposed through logs, referrer headers, browser history, or other side channels in integrated applications. Once an attacker updates a session, downstream services that trust the session state will treat the attacker as the legitimate session owner.
Root Cause
The root cause is a missing authorization check on the session update path in the API layer. The handler validated authentication but did not confirm that the caller possessed the session token or an equivalent permission scope for the requested session resource. This is a classic broken access control pattern mapped to CWE-384 (Session Fixation).
Attack Vector
Exploitation requires network access to the ZITADEL API and a low-privileged authenticated account. The attacker calls the session update endpoint with the target session ID and crafted parameters to associate the session with attacker-controlled state or to alter session lifetime. No user interaction from the victim is required. Successful exploitation yields confidentiality, integrity, and availability impact on the affected user's authenticated context.
No public proof-of-concept exploit is available at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.322%.
Detection Methods for CVE-2025-53895
Indicators of Compromise
- Session update API calls (/zitadel.session.v2.SessionService/SetSession or equivalent gRPC/REST routes) originating from accounts that do not own the target session.
- Sudden changes to active session metadata, including unexpected factor checks, lifetime extensions, or user agent changes.
- Authentication events where the originating IP address or device fingerprint of a session abruptly changes mid-lifetime.
Detection Strategies
- Review ZITADEL audit logs for session.updated events and correlate the actor user ID with the session owner user ID; mismatches indicate potential abuse.
- Alert on session update API requests issued by service accounts or low-privilege users that do not normally invoke session management endpoints.
- Hunt for enumeration patterns against the session API, such as a single principal touching many distinct session IDs in a short window.
Monitoring Recommendations
- Ingest ZITADEL access and admin logs into a centralized SIEM and build dashboards for session API usage by principal.
- Monitor authentication anomalies in downstream applications that consume ZITADEL sessions, including impossible-travel and device-change events.
- Track the deployed ZITADEL version across environments and alert when instances drift below the patched releases.
How to Mitigate CVE-2025-53895
Immediate Actions Required
- Upgrade ZITADEL to a fixed release without delay: 2.70.14, 2.71.13, 3.3.2, or 4.0.0-rc.2.
- Audit recent session update events for unauthorized actors and revoke any suspicious active sessions.
- Rotate credentials and force re-authentication for users whose sessions show signs of tampering.
Patch Information
The ZITADEL maintainers fixed the missing permission check in versions 2.70.14, 2.71.13, 3.3.2, and 4.0.0-rc.2. Refer to the GitHub Security Advisory GHSA-6c5p-6www-pcmr and the release notes for v2.70.14, v2.71.13, v3.3.2, and v4.0.0-rc.2.
Workarounds
- Restrict network access to the ZITADEL session management API to trusted clients only, using ingress policies or a service mesh.
- Reduce the population of authenticated principals on the affected instance by disabling self-registration and tightening IdP federation rules.
- Shorten session lifetimes and require step-up authentication for sensitive downstream operations to limit the value of a hijacked session.
# Verify ZITADEL version and upgrade via Helm to a patched release
kubectl -n zitadel exec deploy/zitadel -- zitadel --version
helm repo update
helm upgrade zitadel zitadel/zitadel \
--namespace zitadel \
--version <chart-version-with-app-2.71.13-or-later>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
