Description
ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.
INFO
Published Date :
2025-07-15T16:39:00.635Z
Last Modified :
2025-07-15T17:19:29.391Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2025-53895 vulnerability.
| Vendors | Products |
|---|---|
| Zitadel |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-53895.
