CVE-2026-55672

Name of the Vulnerable Software and Affected Versions Zitadel versions 4.0.0 through 4.15.1 Zitadel versions 3.0.0 through 3.4.11

Description The OAuth2 / OIDC CodeExchange and RefreshToken implementations fail to validate that the requesting client matches the client that originally initiated the authorization flow, violating RFC 6749 Section 4.1.3. This allows for authorization code injection, where an intercepted code can be exchanged using credentials from a different client registered on the same instance. It also enables refresh token cross-use, allowing a stolen refresh token to be used under a different client identity to maintain persistent access. Additionally, an attacker could finalize a device authorization flow using a different client context than the one that initiated the session. These issues can be exploited if a pre-existing vulnerability or data leak allows for the interception of codes or tokens. Clients using PKCE (Proof Key for Code Exchange), a security extension that ensures the client requesting the token is the same one that requested the authorization code, are partially mitigated against code injection but remain vulnerable to refresh token cross-use.

Recommendations Upgrade Zitadel versions 4.0.0 through 4.15.1 to version 4.15.2 or later. Upgrade Zitadel versions 3.0.0 through 3.4.11 to version 3.4.12 or later. Enforce the use of PKCE for all clients to mitigate authorization code injection risk. Minimize refresh token lifespans to reduce the window of opportunity for token cross-use.