CVE-2026-56668 Details
Description
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.
A vulnerability in ZITADEL's OAuth2 Token Exchange endpoint allows an authenticated user or client to improperly exchange a low-privilege access token for one with elevated permissions in a different application. This issue, present in ZITADEL versions 4.0.0 through 4.15.2 and 3.0.0 through 3.4.12, arises because the endpoint fails to verify that the subject token belongs to the requesting client and does not ensure that requested scopes are within the original token's limits. As a result, an attacker could exploit this flaw to gain unauthorized access to sensitive data or administrative roles by exchanging tokens across different applications.
Users can upgrade to ZITADEL version 4.15.3 or 3.4.13, where this vulnerability has been fixed. If an immediate upgrade is not possible, the Token Exchange feature can be disabled via instance settings or environment variables, or the grant type can be removed from all configured applications.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zitadel/zitadel/commit/e2886a61670ca8fd41c9434f87036546e5620bcc | [email protected] | Source CodeVendor |
| https://github.com/zitadel/zitadel/releases/tag/v4.15.3 | [email protected] | Release NotesVendor |
| https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZITADEL | >= 4.0.0, <= 4.15.2 (semver) >= 3.0.0, <= 3.4.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |