CVE-2025-46815: zitadel Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2025-46815 is a high (CVSS 8.0) Authentication Bypass by Capture-replay vulnerability in zitadel. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.7% of scored vulnerabilities.

Timeline

1. 06-05-2025
   PublishedVulnerability first disclosed.
2. 06-05-2025
   Last modifiedVulnerability information updated.

Description

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."