Junglewise Threat Intelligence

CVE-2026-55672: ZITADEL improper client verification in OAuth2 and OIDC flows

CVE-2026-55672 · Severity: high · CVSS 7.4 · Published 2026-07-10

Executive brief

ZITADEL is an open-source identity management platform used to manage user authentication and access control. A security flaw was found where the system fails to properly verify that the application requesting an access token is the same one that started the login process. If an attacker intercepts a login code or refresh token, they could potentially use it to gain unauthorized access to user data or impersonate users through a different application.

Technical details

The vulnerability exists in ZITADEL's implementation of OAuth2 and OIDC flows, specifically within CodeExchange, RefreshToken, and device token processes. The root cause is a failure to validate that the 'client_id' of the entity requesting a token exchange matches the 'client_id' that originally initiated the authorization request. An attacker who successfully intercepts an authorization grant or a refresh token can exploit this lack of verification to exchange these credentials under the context of a different client. This is classified as improper authentication (CWE-287) and incorrect authorization (CWE-863). The issue is resolved in versions 3.4.12 and 4.15.2.

Affected products

  • ZITADEL ZITADEL < 3.4.12, >= 4.0.0-rc.1, < 4.15.2

Timeline

  • 2026-06-17: patched: Fixes committed and released in versions 3.4.12 and 4.15.2
  • 2026-07-10: disclosed: CVE published to NVD

References

Related threats