Vulnerability in Zitadel
CVE-2025-31123
Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorizatio…
EPSS: 0.004 (60.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Zitadel — versions >= 2.62.0, < 2.63.9, >= 2.64.0-rc.1, < 2.64.6, >= 2.65.0-rc.1, < 2.65.7
Weakness classification (CWE)
References
- https://github.com/zitadel/zitadel/security/advisories/GHSA-h3q7-347g-qwhf (x_refsource_CONFIRM)
- https://github.com/zitadel/zitadel/commit/315503beabd679f2e6aec0c004f0f9d2f5b53ed3 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.63.9 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.64.6 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.65.7 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.66.16 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.67.13 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.68.9 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.69.9 (x_refsource_MISC)
- https://github.com/zitadel/zitadel/releases/tag/v2.70.8 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-31123?
- CVE-2025-31123 is a high-severity vulnerability in Zitadel, classified under Use of a Key Past its Expiration Date. CVSS score: 8.7/10. Published 2025-03-31.
- How severe is CVE-2025-31123?
- High severity. CVSS v3 base score is 8.7 out of 10.