Identity CVE · OAuth / OIDC / JWT
CVE-2025-31123Zitadel JWT auth grant ignores key expiration
high
What broke
Zitadel accepted a JWT authorization grant without checking that the signing key was still inside its validity window. A key you thought you had retired still authenticated the client. The project shipped a patch.
Why it matters
Key expiration is how you contain a leaked machine credential. If the IdP ignores exp on the key (not just on the token), rotation is theater. Open-source IdPs are in a lot of homelab-to-production paths. This is a control you assume exists.
What to do
- Upgrade Zitadel to the patched release.
- Rotate any JWT grant keys that were valid across the vulnerable window, even if they are "expired" in the UI.
- Confirm your other IdPs (Keycloak, authentik) actually enforce key expiry, not only token expiry.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.