CVE-2025-53895: zitadel Session Fixation

Vulnerability summary

CVE-2025-53895 is a high (CVSS 8.8) Session Fixation vulnerability in zitadel. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities.

Timeline

1. 15-07-2025
   PublishedVulnerability first disclosed.
2. 15-07-2025
   Last modifiedVulnerability information updated.

Description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.