CVE-2025-46815
📋 TL;DR
This vulnerability in ZITADEL's Session API allows attackers to repeatedly use idp intents to steal authentication tokens. Attackers with access to the application's URI can authenticate as legitimate users. All ZITADEL deployments before patched versions are affected.
💻 Affected Systems
- ZITADEL
📦 What is this software?
Zitadel by Zitadel
Zitadel by Zitadel
Zitadel by Zitadel
Zitadel by Zitadel
Zitadel by Zitadel
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover allowing attackers to authenticate as any user and access their resources and privileges.
Likely Case
Session hijacking leading to unauthorized access to user accounts and potential data exposure.
If Mitigated
With MFA enabled, attackers cannot complete authentication, preventing full account compromise but still exposing session tokens.
🎯 Exploit Status
Exploitation requires access to the application's URI but no authentication to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0, 2.71.9, or 2.70.10
Vendor Advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq
Restart Required: Yes
Instructions:
1. Backup your ZITADEL configuration and data. 2. Stop ZITADEL service. 3. Upgrade to version 3.0.0, 2.71.9, or 2.70.10 using your package manager or manual installation. 4. Restart ZITADEL service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Enable MFA
allMulti-factor authentication prevents complete authentication even if tokens are stolen
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to ZITADEL URIs
- Enable comprehensive logging and monitoring for suspicious session activities
🔍 How to Verify
Check if Vulnerable:
Check ZITADEL version - if below 3.0.0, 2.71.9, or 2.70.10, the system is vulnerable.Check Version:
zitadel version (or check ZITADEL admin interface)Verify Fix Applied:
Verify ZITADEL version is 3.0.0, 2.71.9, or 2.70.10 or higher after upgrade.📡 Detection & Monitoring
Log Indicators:
- Multiple idp intent requests from same source
- Unusual session creation patterns
- Authentication attempts with reused tokens
Network Indicators:
- Repeated requests to idp intent endpoints
- Abnormal traffic to session API URIs
SIEM Query:
source="zitadel" AND (event="idp_intent" OR event="session_create") | stats count by src_ip, user | where count > threshold🔗 References
- https://github.com/zitadel/zitadel/commit/b1e60e7398d677f08b06fd7715227f70b7ca1162
- https://github.com/zitadel/zitadel/releases/tag/v2.70.10
- https://github.com/zitadel/zitadel/releases/tag/v2.71.9
- https://github.com/zitadel/zitadel/releases/tag/v3.0.0
- https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq
