Overview
The CVE-2025-46815 is a vulnerability found in the identity infrastructure software ZITADEL. This software is primarily used by developers for managing user sessions using the Session API. The vulnerability allows for exploitation of the software’s idp intents feature that could potentially lead to system compromise or data leakage. This vulnerability is particularly significant as it affects any organization or individual that uses versions of ZITADEL prior to 3.0.0, 2.71.9, and 2.70.10, potentially exposing their system to unauthorized access.
Vulnerability Summary
CVE ID: CVE-2025-46815
Severity: High, CVSS score of 8.0
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
You just read how systems get breached.
What most apps won’t tell you is — they’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
ZITADEL | Versions prior to 3.0.0, 2.71.9, 2.70.10
How the Exploit Works
The exploit works by taking advantage of ZITADEL’s idp intents feature. Upon successful idp intent, the client receives an id and token on a predefined URI. These id and token are then used to authenticate the user or their session. In versions prior to 3.0.0, 2.71.9, and 2.70.10, an attacker can exploit this feature by repeatedly using intents. With access to the application’s URI, the attacker can retrieve the id and token, and authenticate on behalf of the user.
Conceptual Example Code
This is a conceptual example of how the vulnerability might be exploited:
GET /intent/idp HTTP/1.1
Host: target.example.com
{
"id": "repeatedly-generated-id",
"token": "repeatedly-generated-token"
}The attacker would repeatedly send this GET request, using repeatedly generated id and token, to the URI where the client receives them. Successful exploitation would allow the attacker to authenticate on behalf of the user, potentially compromising the system and leading to data leakage.
Recommended Mitigations
The best mitigation for this vulnerability is to upgrade to ZITADEL versions 3.0.0, 2.71.9, or 2.70.10, which contain a fix for the issue. If upgrading is not an immediate option, implementing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation. However, these measures may not completely secure the system from exploitation. As such, upgrading the software to the secure versions is highly recommended.