Executive brief
ZITADEL is an open-source identity management platform used to manage user authentication and access control. A security flaw was found where the system fails to properly verify that the application requesting an access token is the same one that started the login process. If an attacker intercepts a login code or refresh token, they could potentially use it to gain unauthorized access to user data or impersonate users through a different application.
Technical details
The vulnerability exists in ZITADEL's implementation of OAuth2 and OIDC flows, specifically within CodeExchange, RefreshToken, and device token processes. The root cause is a failure to validate that the 'client_id' of the entity requesting a token exchange matches the 'client_id' that originally initiated the authorization request. An attacker who successfully intercepts an authorization grant or a refresh token can exploit this lack of verification to exchange these credentials under the context of a different client. This is classified as improper authentication (CWE-287) and incorrect authorization (CWE-863). The issue is resolved in versions 3.4.12 and 4.15.2.
Affected products
- ZITADEL ZITADEL < 3.4.12, >= 4.0.0-rc.1, < 4.15.2
Timeline
- 2026-06-17: patched: Fixes committed and released in versions 3.4.12 and 4.15.2
- 2026-07-10: disclosed: CVE published to NVD
References
- https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71
- https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917
- https://github.com/zitadel/zitadel/releases/tag/v3.4.12
- https://github.com/zitadel/zitadel/releases/tag/v4.15.2
- https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x