CVE-2026-56664 Details
Description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication. This issue is fixed in versions 3.4.12 and 4.15.2.
A vulnerability exists in ZITADEL's external JWT Identity Provider (IdP) validation process, specifically in versions 3.4.11 prior to 3.4.12 and 4.0.0 through 4.15.1. The issue arises because the validation logic skips the maximum token age check when the 'issued at' (iat) claim is absent, allowing old tokens from trusted issuers to be accepted for authentication. This flaw can be exploited to reuse stale tokens indefinitely, bypassing session expiration controls.
Users can upgrade to ZITADEL versions 3.4.12 or 4.15.2, both of which include the necessary validation for the 'iat' claim. If an immediate upgrade is not possible, ensure that the upstream Identity Provider includes the 'iat' claim in all signed JWTs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8 | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/releases/tag/v3.4.12 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/releases/tag/v4.15.2 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.15.1 (semver) >= 3.0.0, <= 3.4.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |