{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.62.0"
              },
              {
                "fixed": "2.63.9"
              }
            ]
          },
          "events": [
            {
              "introduced": "6210239ed5b8c92bc63d14d050137d2985e99bce"
            },
            {
              "fixed": "90255ef7d8144a922a7357428cd317b95e41d17a"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.64.0-rc.1"
              },
              {
                "fixed": "2.64.6"
              }
            ]
          },
          "events": [
            {
              "introduced": "710a929fad39a83169aa6797487ec7aefb8a4bd8"
            },
            {
              "fixed": "9a614fa98d00cbb0127a6f374da5b00aa5dd12b6"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.65.0-rc.1"
              },
              {
                "fixed": "2.65.7"
              }
            ]
          },
          "events": [
            {
              "introduced": "0aba000355d8f47c213c27b15f9eedc51241a1e3"
            },
            {
              "fixed": "12ad907d3e36a0db735719c552e5135ae9e9f4bd"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.66.0-rc.1"
              },
              {
                "fixed": "2.66.16"
              }
            ]
          },
          "events": [
            {
              "introduced": "e4ebac13aa662bc22574bedf7c33d7c028b783e1"
            },
            {
              "fixed": "2a889a98533cff2e10cf108eb5c649e47d0dca78"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.67.0-rc.1"
              },
              {
                "fixed": "2.67.13"
              }
            ]
          },
          "events": [
            {
              "introduced": "7dc23a749c03eb0c8a4aad30413c2d5b38f89ebc"
            },
            {
              "fixed": "596567deb93499b22d2bb4a9be99cf8a557e4196"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.68.0-rc.1"
              },
              {
                "fixed": "2.68.9"
              }
            ]
          },
          "events": [
            {
              "introduced": "a8e93a77c2ac0ea5733cad7f28c6ce96367724e6"
            },
            {
              "fixed": "bb5db00e948bc8327aed99b2f82383ba46a7ca9c"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.69.0-rc.1"
              },
              {
                "fixed": "2.69.9"
              }
            ]
          },
          "events": [
            {
              "introduced": "8b881f542b621c53e9ca5dd8bd6d62d2f90d4315"
            },
            {
              "fixed": "314cc1495bd734afe78a2df6955df5ce8288de9a"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.70.0-rc.1"
              },
              {
                "fixed": "2.70.8"
              }
            ]
          },
          "events": [
            {
              "introduced": "99c2247ecb36754619617df0c7266162bf37b877"
            },
            {
              "fixed": "318761fd879c81ac1716bacfb2f84d8374efd92c"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        },
        {
          "database_specific": {
            "versions": [
              {
                "introduced": "2.71.0-rc.1"
              },
              {
                "fixed": "2.71.6"
              }
            ]
          },
          "events": [
            {
              "introduced": "732fc6040f69a6703af28151ce2b6cba6e430836"
            },
            {
              "fixed": "4fde7822d8f728007fb0781690a4f8a6d47a1868"
            }
          ],
          "repo": "https://github.com/zitadel/zitadel",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-h3q7-347g-qwhf"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-324"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31123.json"
  },
  "details": "Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.",
  "id": "CVE-2025-31123",
  "modified": "2026-04-01T23:08:35.381779008Z",
  "published": "2025-03-31T19:31:40.507Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.63.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.64.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.65.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.66.16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.67.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.68.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.69.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.70.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31123.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-h3q7-347g-qwhf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31123"
    },
    {
      "type": "FIX",
      "url": "https://github.com/zitadel/zitadel/commit/315503beabd679f2e6aec0c004f0f9d2f5b53ed3"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zitadel Expired JWT Keys Usable for Authorization Grants"
}