CVE-2025-31123
Zitadel 2.62.0 – 2.63.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:NSummary
CVE-2025-31123 is a high-severity Use of a Key Past its Expiration Date (CWE-324) vulnerability in Zitadel Zitadel. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-31123 is a vulnerability in Zitadel, an open-source identity infrastructure software, where expired JWT keys can be used to retrieve valid access tokens. Specifically, Zitadel fails to properly check the expiration date of JWT keys during Authorization Grants, enabling this bypass. The issue does not affect JWT Profile usage for OAuth 2.0 Client Authentication on Token and Introspection endpoints, which correctly reject expired keys. It carries a CVSS score of 8.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) and maps to CWE-324 (Missing Required Cryptographic Step).
Exploitation requires high privileges (PR:H) and is network-accessible (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). A privileged attacker possessing an expired JWT key—such as a service account or authorized client—can submit it for Authorization Grants to obtain fresh, valid access tokens. This leads to high confidentiality (C:H) and integrity (I:H) impacts with scope expansion (S:C), potentially allowing unauthorized access to protected resources.
The vulnerability is addressed in Zitadel releases 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9. Mitigation involves upgrading to one of these patched versions. The fixing commit is at https://github.com/zitadel/zitadel/commit/315503beabd679f2e6aec0c004f0f9d2f5b53ed3, with release details at the corresponding tags such as https://github.com/zitadel/zitadel/releases/tag/v2.63.9.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8872
Vulnerability Data
Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker…
more
with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-12 requires establishing and managing cryptographic keys including distribution, storage, access and destruction, which directly enforces expiration and rotation policies.
IA-5 requires managing authenticators (including passwords and tokens) with verification, distribution and revocation steps that cover expiration enforcement.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Lifecycle management of cryptographic assets directly includes enforcing key expiration and rotation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use-of-cryptography control explicitly covers key lifecycle management including expiration and rotation.
Authentication information policy should mandate key rotation and expiry, directly preventing use of expired keys.
Change-management processes can trigger key rotation, but do not inherently enforce cryptographic expiry rules.
Secure authentication requires cryptographic keys to be replaced before expiry, mitigating the weakness.