CVE-2026-55672 Details
Description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.
A vulnerability exists in ZITADEL's OAuth2 and OpenID Connect (OIDC) implementations, specifically in the authorization code exchange, refresh token, and device token flows. Prior to versions 3.4.12 and 4.15.2, these flows failed to verify that the requesting client matched the client that initiated the authorization process. This oversight allowed intercepted authorization codes or refresh tokens to be exchanged under a different client identity, violating RFC 6749 Section 4.1.3. The vulnerability affects ZITADEL versions 4.0.0 through 4.15.1 and 3.0.0 through 3.4.11.
Users should upgrade to ZITADEL versions 3.4.12 or 4.15.2, where this vulnerability has been addressed by reintroducing strict client identity validation in the affected OAuth2 and OIDC flows.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71 | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917 | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/releases/tag/v3.4.12 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/releases/tag/v4.15.2 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.15.1 (semver) >= 3.0.0, <= 3.4.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |