« Volver al listado

CVE-2025-46815

Estado: AnalizadaAlta (8)—

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents.

Leer descripción completaMostrar menos

This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R indica interacción del usuario (reutilización de intents). Riesgo de suplantación (T1078.004) y uso de tokens ajenos (T1550.001, acceso con credenciales obtenidas).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Account Use PoliciesApplication Developer GuidanceActive Directory ConfigurationUser TrainingUser Account ManagementRestrict Web-Based Content

Tecnologías afectadas (1)

Zitadel — Zitadel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-46815",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-46815",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-06T18:20:59.907100Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "zitadel",
          "product": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0-rc.1, < 3.0.0"
            },
            {
              "status": "affected",
              "version": "< 2.70.10"
            },
            {
              "status": "affected",
              "version": ">= 2.71.0, < 2.71.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-05-06T18:15:38.697",
  "references": [
    {
      "url": "https://github.com/zitadel/zitadel/commit/b1e60e7398d677f08b06fd7715227f70b7ca1162",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.70.10",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.9",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/releases/tag/v3.0.0",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        },
        {
          "lang": "en",
          "value": "CWE-384"
        },
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available."
    },
    {
      "lang": "es",
      "value": "El software de infraestructura de identidad ZITADEL ofrece a los desarrolladores la posibilidad de gestionar sesiones de usuario mediante la API de sesión. Esta API permite el uso de proveedores de identidad (IdP) para la autenticación, conocidos como intentos de IdP. Tras un intento de IdP exitoso, el cliente recibe un ID y un token en una URI predefinida. Estos ID y token pueden utilizarse para autenticar al usuario o su sesión. Sin embargo, antes de las versiones 3.0.0, 2.71.9 y 2.70.10, era posible explotar esta función mediante el uso repetido de intentos. Esto permitía a un atacante con acceso a la URI de la aplicación recuperar el ID y el token, lo que le permitía autenticarse en nombre del usuario. Es importante tener en cuenta que el uso de factores adicionales (MFA) impide un proceso de autenticación completo y, en consecuencia, el acceso a la API de ZITADEL. Las versiones 3.0.0, 2.71.9 y 2.70.10 contienen una solución para este problema. No se conocen workarounds aparte de la actualización."
    }
  ],
  "lastModified": "2026-06-17T09:26:58.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB81BA21-8C67-4F1E-805C-AC4C3A9EA615",
              "versionEndExcluding": "2.70.10"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "610C62A5-5011-4AA5-A2A6-0BCF1FCCAE6D",
              "versionEndExcluding": "2.71.9",
              "versionStartIncluding": "2.71.0"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:3.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF5C93C9-31A9-49A7-8048-858009EF7A4D"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:3.0.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDAAF299-A1D8-4C62-9E98-63FAEAB12DE5"
            },
            {
              "criteria": "cpe:2.3:a:zitadel:zitadel:3.0.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "181336F8-4D7F-42F3-AD85-AB44445550AA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}