Overview
The CVE-2025-46815 is a vulnerability found in the identity infrastructure software ZITADEL. This software is primarily used by developers for managing user sessions using the Session API. The vulnerability allows for exploitation of the software’s idp intents feature that could potentially lead to system compromise or data leakage. This vulnerability is particularly significant as it affects any organization or individual that uses versions of ZITADEL prior to 3.0.0, 2.71.9, and 2.70.10, potentially exposing their system to unauthorized access.
Vulnerability Summary
CVE ID: CVE-2025-46815
Severity: High, CVSS score of 8.0
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise and potential data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
ZITADEL | Versions prior to 3.0.0, 2.71.9, 2.70.10
How the Exploit Works
The exploit works by taking advantage of ZITADEL’s idp intents feature. Upon successful idp intent, the client receives an id and token on a predefined URI. These id and token are then used to authenticate the user or their session. In versions prior to 3.0.0, 2.71.9, and 2.70.10, an attacker can exploit this feature by repeatedly using intents. With access to the application’s URI, the attacker can retrieve the id and token, and authenticate on behalf of the user.
Conceptual Example Code
This is a conceptual example of how the vulnerability might be exploited:
GET /intent/idp HTTP/1.1
Host: target.example.com
{
"id": "repeatedly-generated-id",
"token": "repeatedly-generated-token"
}The attacker would repeatedly send this GET request, using repeatedly generated id and token, to the URI where the client receives them. Successful exploitation would allow the attacker to authenticate on behalf of the user, potentially compromising the system and leading to data leakage.
Recommended Mitigations
The best mitigation for this vulnerability is to upgrade to ZITADEL versions 3.0.0, 2.71.9, or 2.70.10, which contain a fix for the issue. If upgrading is not an immediate option, implementing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation. However, these measures may not completely secure the system from exploitation. As such, upgrading the software to the secure versions is highly recommended.