CVE-2025-31123

CVE-2025-31123 — Zitadel (open-source identity infrastructure) : A vulnerability exists where Zitadel fails to properly check the expiration date of the JWT key when used for Authorization Grants. An attacker with an expired key can obtain valid access tokens, while the JWT Profile for OAuth 2.0 ...

CVE-2025-31123: Use of a Key Past its Expiration Date

Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to...