Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-56665ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Medium 4.2

In plain English

A medium-severity security flaw in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.3%top 81.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips expiration handling when an incoming token omits the exp claim, allowing a token from a trusted issuer to be treated as valid without an automatic expiration window. This issue is fixed in versions 3.4.12 and 4.15.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/zitadel/zitadel4.15.2GHSA-v77h-2w3m-94hx
Gogithub.com/zitadel/zitadel3.4.12GHSA-v77h-2w3m-94hx
Gogithub.com/zitadel/zitadelno fix listedGO-2026-6469

Affected products (as reported)

VendorProductVersions
zitadel zitadel >= 4.0.0-rc.1, < 4.15.2< 3.4.12

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References