CVE-2025-53895HIGH 8.8EPSS p25.7%

CVE-2025-53895CVE-2025-53895

Description

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission check. This flaw enables session hijacking, allowing an attacker to impersonate another user and access sensitive resources. Versions prior to `2.53.0` are not affected, as they required the session token for updates. Versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14 fix the issue.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS0.34% probability of exploitation · percentile 25.7% · 2026-06-19T12:03:05Z
Published2025-07-15
Last modified2025-08-26

Underlying weaknesses· 2

CWE-384CWE-863

References

  1. https://github.com/zitadel/zitadel/releases/tag/v2.70.14
  2. https://github.com/zitadel/zitadel/releases/tag/v2.71.13
  3. https://github.com/zitadel/zitadel/releases/tag/v3.3.2
  4. https://github.com/zitadel/zitadel/releases/tag/v4.0.0-rc.2
  5. https://github.com/zitadel/zitadel/security/advisories/GHSA-6c5p-6www-pcmr

2

TypeTargetConfidenceTier
WeaknessSession Fixationcwe-3840%live
WeaknessIncorrect Authorizationcwe-8630%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-46815
CVE
CVE-2025-64717
CVE
CVE-2026-29191
CVE
CVE-2025-67494
CVE
CVE-2025-27507
CVE
CVE-2026-29193
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.