CVE-2025-31123Zitadel JWT auth grant ignores key expiration
What broke
Zitadel accepted a JWT authorization grant without checking that the signing key was still inside its validity window. A key you thought you had retired still authenticated the client. The project shipped a patch.
Why it matters
Key expiration is how you contain a leaked machine credential. If the IdP ignores exp on the key (not just on the token), rotation is theater. Open-source IdPs are in a lot of homelab-to-production paths. This is a control you assume exists.
What to do
- Upgrade Zitadel to the patched release.
- Rotate any JWT grant keys that were valid across the vulnerable window, even if they are "expired" in the UI.
- Confirm your other IdPs (Keycloak, authentik) actually enforce key expiry, not only token expiry.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
Related identity CVEs
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- CVEICS JWT auth bypass via hard-coded constants
An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f
- CVESharePoint JWT alg:none, impersonate any user
SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9