CVE-2025-46815: zitadel Session Fixation — Fix

Description

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available.

Is your site exposed to CVE-2025-46815?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.0

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness Type (CWE)

CWE-294 CWE-294

CWE-384 CWE-384

CWE-613 CWE-613

Affected Products

Vendor	Product	Versions
zitadel	zitadel	< 2.70.10
zitadel	zitadel	2.71.0 — 2.71.9
zitadel	zitadel	All
zitadel	zitadel	All
zitadel	zitadel	All

References

Advisories & Patches

https://github.com/zitadel/zitadel/commit/b1e60e7398d677f08b06fd7715227f70b7ca1162 https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq

Other References

https://github.com/zitadel/zitadel/releases/tag/v2.70.10 https://github.com/zitadel/zitadel/releases/tag/v2.71.9 https://github.com/zitadel/zitadel/releases/tag/v3.0.0

Frequently Asked Questions

What is CVE-2025-46815? +

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available. It has a CVSS v3.1 base score of 8.0 (HIGH).

How severe is CVE-2025-46815? +

CVE-2025-46815 has a CVSS v3.1 score of 8.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-46815? +

CVE-2025-46815 affects products from zitadel, specifically: zitadel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-46815? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-34021

The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller without cryptographic …

CVE-2025-8616

A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process …

CVE-2024-38284

Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a …

CVE-2025-1887

SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with …

CVE-2026-56130

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie …

CVE-2025-6029

Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key …

CVE-2025-46815