CVE-2026-56664
MEDIUMZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
Title source: cnaDescription
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication. This issue is fixed in versions 3.4.12 and 4.15.2.
References (5)
Core 5
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g
X_Refsource_Misc x_refsource_misc
https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8
X_Refsource_Misc x_refsource_misc
https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac
X_Refsource_Misc x_refsource_misc
https://github.com/zitadel/zitadel/releases/tag/v3.4.12
X_Refsource_Misc x_refsource_misc
https://github.com/zitadel/zitadel/releases/tag/v4.15.2
Scores
CVSS v3
4.2
EPSS
0.0020
EPSS Percentile
10.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-613
Status
published
Products (3)
zitadel/zitadel
0 - 1.80.0-v2.20.0.20260615122908-fad02c6d9f45Go
zitadel/zitadel
< 3.4.12
zitadel/zitadel
>= 4.0.0-rc.1, < 4.15.2
Published
Jul 10, 2026
Tracked Since
Jul 10, 2026