CVE-2026-56668

HIGH

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Title source: cna
STIX 2.1

Description

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.

References (3)

Core 3

Scores

CVSS v3 8.1
EPSS 0.0023
EPSS Percentile 14.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-862
Status published
Products (1)
zitadel/zitadel < 4.15.3
Published Jul 10, 2026
Tracked Since Jul 10, 2026