CVE-2026-56668

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.15.3

Description The OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange fails to verify if the subject token belongs to the requesting client or if the requested scopes are within the original token's scopes. This allows a token with low privileges to be exchanged for one with elevated permissions at another application.

Recommendations Update to version 4.15.3.