CVE-2025-53895

Katalog CVE

CVSS 8.8 · High EPSS 0,38%

Kerentanan Session Fixation pada zitadel. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

Rincian

Terbit di NVD

15 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/security/advisories/GHSA-6c5p-6www-pcmr advisory vendor
• https://github.com/zitadel/zitadel/releases/tag/v2.70.14 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.71.13 release notes
• https://github.com/zitadel/zitadel/releases/tag/v3.3.2 release notes
• https://github.com/zitadel/zitadel/releases/tag/v4.0.0-rc.2 release notes