CVE-2025-31123

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-31123
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31123.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-31123
Aliases
  • GHSA-h3q7-347g-qwhf
Published
2025-03-31T19:31:40.507Z
Modified
2026-04-10T05:24:55.164443Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Zitadel Expired JWT Keys Usable for Authorization Grants
Details

Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31123.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-324"
    ]
}
References

Affected packages

Git / github.com/zitadel/zitadel

Affected ranges

Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
6210239ed5b8c92bc63d14d050137d2985e99bce
Fixed
90255ef7d8144a922a7357428cd317b95e41d17a
Database specific 
{
    "versions": [
        {
            "introduced": "2.62.0"
        },
        {
            "fixed": "2.63.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
710a929fad39a83169aa6797487ec7aefb8a4bd8
Fixed
9a614fa98d00cbb0127a6f374da5b00aa5dd12b6
Database specific 
{
    "versions": [
        {
            "introduced": "2.64.0-rc.1"
        },
        {
            "fixed": "2.64.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
0aba000355d8f47c213c27b15f9eedc51241a1e3
Fixed
12ad907d3e36a0db735719c552e5135ae9e9f4bd
Database specific 
{
    "versions": [
        {
            "introduced": "2.65.0-rc.1"
        },
        {
            "fixed": "2.65.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
e4ebac13aa662bc22574bedf7c33d7c028b783e1
Fixed
2a889a98533cff2e10cf108eb5c649e47d0dca78
Database specific 
{
    "versions": [
        {
            "introduced": "2.66.0-rc.1"
        },
        {
            "fixed": "2.66.16"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
7dc23a749c03eb0c8a4aad30413c2d5b38f89ebc
Fixed
596567deb93499b22d2bb4a9be99cf8a557e4196
Database specific 
{
    "versions": [
        {
            "introduced": "2.67.0-rc.1"
        },
        {
            "fixed": "2.67.13"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
a8e93a77c2ac0ea5733cad7f28c6ce96367724e6
Fixed
bb5db00e948bc8327aed99b2f82383ba46a7ca9c
Database specific 
{
    "versions": [
        {
            "introduced": "2.68.0-rc.1"
        },
        {
            "fixed": "2.68.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
8b881f542b621c53e9ca5dd8bd6d62d2f90d4315
Fixed
314cc1495bd734afe78a2df6955df5ce8288de9a
Database specific 
{
    "versions": [
        {
            "introduced": "2.69.0-rc.1"
        },
        {
            "fixed": "2.69.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
99c2247ecb36754619617df0c7266162bf37b877
Fixed
318761fd879c81ac1716bacfb2f84d8374efd92c
Database specific 
{
    "versions": [
        {
            "introduced": "2.70.0-rc.1"
        },
        {
            "fixed": "2.70.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/zitadel/zitadel
Events
Introduced
732fc6040f69a6703af28151ce2b6cba6e430836
Fixed
4fde7822d8f728007fb0781690a4f8a6d47a1868
Database specific 
{
    "versions": [
        {
            "introduced": "2.71.0-rc.1"
        },
        {
            "fixed": "2.71.6"
        }
    ]
}

Affected versions

v2.*
v2.62.0
v2.62.1
v2.62.2
v2.62.3
v2.63.0
v2.63.1
v2.63.2
v2.63.3
v2.63.4
v2.63.5
v2.63.6
v2.63.7
v2.63.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31123.json"