CVE-2026-55669 PUBLISHED

ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider

Assigner: GitHub_M
Reserved: 17.06.2026 Published: 10.07.2026 Updated: 10.07.2026

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer (iss) but not the audience (aud) claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted by ZITADEL. This issue is fixed in versions 3.4.12 and 4.15.2.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 4.2

Product Status

Vendor zitadel
Product zitadel
Versions
  • Version >= 4.0.0-rc.1, < 4.15.2 is affected
  • Version < 3.4.12 is affected

References

Problem Types

  • CWE-346: Origin Validation Error CWE