CVE-2026-55669 Details
Description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer (iss) but not the audience (aud) claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted by ZITADEL. This issue is fixed in versions 3.4.12 and 4.15.2.
A vulnerability exists in ZITADEL's external JWT Identity Provider (IdP) validation process. In versions prior to 3.4.12 and 4.15.2, the IdP correctly verifies a token's signature and issuer but neglects the audience claim. This oversight allows a validly signed token from a trusted issuer, intended for a different relying party, to be accepted by ZITADEL. Consequently, an attacker with a valid token from another service could authenticate as a user in ZITADEL without proper authorization.
Users can upgrade to ZITADEL versions 3.4.12 or 4.15.2, where this vulnerability has been fixed. If an immediate upgrade is not possible, it is recommended to ensure that the external Identity Provider issues tokens with unique audience values that cannot be confused with those of other services. Alternatively, a reverse proxy, API gateway, or Web Application Firewall can be deployed to inspect and filter incoming identity tokens based on the audience claim.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zitadel/zitadel/releases/tag/v3.4.12 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/releases/tag/v4.15.2 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-g5h5-m4hm-xjrr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.15.1 (semver) <= 3.4.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |