CVE-2026-56665

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0-rc.1 through 3.4.11 ZITADEL versions 4.0.0-rc.1 through 4.15.1

Description External JWT Identity Provider validation in the internal/idp/providers/jwt/session.go file skips expiration handling when an incoming token omits the exp claim. This allows a token from a trusted issuer to be treated as valid without an automatic expiration window.

Recommendations Update ZITADEL versions 3.0.0-rc.1 through 3.4.11 to version 3.4.12. Update ZITADEL versions 4.0.0-rc.1 through 4.15.1 to version 4.15.2.