CVE-2025-31123: Zitadel is open-source identity infrastructure software

Description

Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 35% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

ZI

Zitadel · Zitadel

2.62.0 before 2.63.9; 2.64.0 before 2.64.6; 2.65.0 before 2.65.7; 2.66.0 before 2.66.16; 2.67.0 before 2.67.13; 2.68.0 before 2.68.9; +3 more · source: NVD