PT-2026-57253 · Zitadel · Zitadel
CVE-2026-56665
·
Published
2026-07-10
·
Updated
2026-09-11
CVSS v3.1
4.2
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
ZITADEL versions 3.0.0-rc.1 through 3.4.11
ZITADEL versions 4.0.0-rc.1 through 4.15.1
Description
External JWT Identity Provider validation in the
internal/idp/providers/jwt/session.go file skips expiration handling when an incoming token omits the exp claim. This allows a token from a trusted issuer to be treated as valid without an automatic expiration window.Recommendations
Update ZITADEL versions 3.0.0-rc.1 through 3.4.11 to version 3.4.12.
Update ZITADEL versions 4.0.0-rc.1 through 4.15.1 to version 4.15.2.
Exploit
Fix
Insufficient Session Expiration
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zitadel