CVE-2026-56665 Details
Description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips expiration handling when an incoming token omits the exp claim, allowing a token from a trusted issuer to be treated as valid without an automatic expiration window. This issue is fixed in versions 3.4.12 and 4.15.2.
A vulnerability exists in ZITADEL's external JWT Identity Provider (IdP) validation process, specifically in versions 3.0.0-rc.1 through 3.4.11 and 4.0.0-rc.1 through 4.15.1. The issue arises because the validation pipeline skips checking the expiration (`exp`) claim in tokens from trusted issuers, allowing these tokens to be considered valid indefinitely. This oversight can lead to session integrity issues, as tokens without an expiration claim are accepted without any automatic revocation or expiration. The vulnerability has been addressed in ZITADEL versions 3.4.12 and 4.15.2.
Users can upgrade to ZITADEL versions 3.4.12 or 4.15.2, both of which include the necessary fix. Instructions for downloading these versions are available on the ZITADEL GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8 | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/releases/tag/v3.4.12 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/releases/tag/v4.15.2 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.15.1 (semver) >= 3.0.0-rc.1, <= 3.4.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |