CVE-2026-55672: ZITADEL improper client verification in OAuth2 and OIDC flows

CVE-2026-55672 · Severity: high · CVSS 7.4 · Published 2026-07-10

ZITADEL is an open-source identity management platform used to manage user authentication and access control. A security flaw was found where the system fails to properly verify that the application requesting an access token is the same one that started the login process. If an attacker intercepts a login code or refresh token, they could potentially use it to gain unauthorized access to user data or impersonate users through a different application.

Technologies: github.com/zitadel/zitadel (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2026-55672 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55672 being exploited in the wild.
How severe is CVE-2026-55672?
High severity, with a CVSS score of 7.4, published 10 July 2026.
Which products and versions are affected?
github.com/zitadel/zitadel (Go) < 1.80.0-v2.20.0.20260616131956-0973b074b488, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260616131956-0973b074b488; ZITADEL < 3.4.12, >= 4.0.0-rc.1, < 4.15.2, 3.0.0 to 3.4.11, 4.0.0 to 4.15.1.
Is there a fix for CVE-2026-55672?
Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55672 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55672?
Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later
    go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260616131956-0973b074b488

Technical details

The vulnerability exists in ZITADEL's implementation of OAuth2 and OIDC flows, specifically within CodeExchange, RefreshToken, and device token processes. The root cause is a failure to validate that the 'client_id' of the entity requesting a token exchange matches the 'client_id' that originally initiated the authorization request. An attacker who successfully intercepts an authorization grant or a refresh token can exploit this lack of verification to exchange these credentials under the context of a different client. This is classified as improper authentication (CWE-287) and incorrect authorization (CWE-863). The issue is resolved in versions 3.4.12 and 4.15.2.

Affected products

  • ZITADEL ZITADEL < 3.4.12, >= 4.0.0-rc.1, < 4.15.2

Identifiers

  • CVE-2026-55672
  • GHSA-xqxv-4jc2-x56x
  • GO-2026-5768

Timeline

  • 2026-06-17: patched: Fixes committed and released in versions 3.4.12 and 4.15.2
  • 2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.