CVE-2025-31123

HIGH EPSS 27.9%
Published Mar 31, 20251y ago · Modified Jun 17, 20262w ago
8.7 CVSS 3.1
High
Find Similar
Published Mar 31, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

CVSS Details

Base Score
8.7
Exploitability
2.3
Impact
5.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
27.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-324

Affected Products 9

VendorProductVersionRange
zitadelzitadel*≥2.62.0  –  <2.63.9
zitadelzitadel*≥2.64.0  –  <2.64.6
zitadelzitadel*≥2.65.0  –  <2.65.7
zitadelzitadel*≥2.66.0  –  <2.66.16
zitadelzitadel*≥2.67.0  –  <2.67.13
zitadelzitadel*≥2.68.0  –  <2.68.9
zitadelzitadel*≥2.69.0  –  <2.69.9
zitadelzitadel*≥2.70.0  –  <2.70.8
zitadelzitadel*≥2.71.0  –  <2.71.6

References 11

  • github.com https://github.com/zitadel/zitadel/commit/315503beabd679f2e6aec0c004f0f9d2f5b53ed3
    Patch
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.63.9
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.64.6
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.65.7
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.66.16
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.67.13
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.68.9
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.69.9
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.70.8
    Release Notes
  • github.com https://github.com/zitadel/zitadel/releases/tag/v2.71.6
    Release Notes
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-h3q7-347g-qwhf
    Vendor Advisory

Remediation

  • github.com https://github.com/zitadel/zitadel/commit/315503beabd679f2e6aec0c004f0f9d2f5b53ed3
    Patch