CVE-2025-31123 Details
Description
Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
A vulnerability in Zitadel's identity infrastructure software allows expired JSON Web Token (JWT) keys to be used in Authorization Grants, enabling the retrieval of valid access tokens. This issue arises because Zitadel does not properly validate the expiration date of JWT keys in this context. As a result, an attacker can exploit an expired key to obtain access tokens. However, this vulnerability does not impact the JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys.
Users are advised to update Zitadel to version 2.71.6 or later, or to version 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, or 2.63.9.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-324 | Use of a Key Past its Expiration Date | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zitadel zitadel | >= 2.62.0, < 2.63.9 >= 2.64.0, < 2.64.6 >= 2.65.0, < 2.65.7 >= 2.66.0, < 2.66.16 >= 2.67.0, < 2.67.13 >= 2.68.0, < 2.68.9 >= 2.69.0, < 2.69.9 >= 2.70.0, < 2.70.8 >= 2.71.0, < 2.71.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 26, 2025 | Initial Analysis | [email protected] |
| Mar 31, 2025 | New CVE Received | [email protected] |