CVE-2025-31123

Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.

Scoring

Severity

HIGH

CVSS base score

8.7

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

EPSS probability

0.39%

CWE

CWE-324

Published

2025-03-31

Last modified

2026-03-12

Affected products

• zitadel zitadel
• zitadel zitadel
• zitadel zitadel
• zitadel zitadel
• zitadel zitadel
• zitadel zitadel
• zitadel zitadel
• zitadel zitadel

Weakness type

• CWE-324

Related vulnerabilities

• CVE-2026-39923 — Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
• CVE-2026-54787 — sigstore-go fails to check signature timestamps against a signing key's validity period
• CVE-2026-52809 — Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
• CVE-2025-33012 — IBM Db2 improper account lockout
• CVE-2025-48813 — Virtual Secure Mode Spoofing Vulnerability
• CVE-2023-5342 — Shim: expired secure boot certificate
• CVE-2025-2291 — PgBouncer default auth_query does not take Postgres password expiry into account
• CVE-2024-7318 — Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

Markdown version · Browse all CVEs