# CVE-2026-55672: ZITADEL improper client verification in OAuth2 and OIDC flows

Source: https://junglewise.ai/threats/cve-2026-55672-zitadel-improper-client-verification-in-oauth2-and-oidc-flows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55672 · Severity: high · CVSS 7.4 · Published 2026-07-10

ZITADEL is an open-source identity management platform used to manage user authentication and access control. A security flaw was found where the system fails to properly verify that the application requesting an access token is the same one that started the login process. If an attacker intercepts a login code or refresh token, they could potentially use it to gain unauthorized access to user data or impersonate users through a different application.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel), [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-55672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55672 being exploited in the wild.

**How severe is CVE-2026-55672?** High severity, with a CVSS score of 7.4, published 10 July 2026.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) < 1.80.0-v2.20.0.20260616131956-0973b074b488, SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260616131956-0973b074b488; ZITADEL < 3.4.12, >= 4.0.0-rc.1, < 4.15.2, 3.0.0 to 3.4.11, 4.0.0 to 4.15.1.

**Is there a fix for CVE-2026-55672?** Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55672 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55672?** Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later

  ```sh
  go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260616131956-0973b074b488
  ```


## Technical details

The vulnerability exists in ZITADEL's implementation of OAuth2 and OIDC flows, specifically within CodeExchange, RefreshToken, and device token processes. The root cause is a failure to validate that the 'client_id' of the entity requesting a token exchange matches the 'client_id' that originally initiated the authorization request. An attacker who successfully intercepts an authorization grant or a refresh token can exploit this lack of verification to exchange these credentials under the context of a different client. This is classified as improper authentication (CWE-287) and incorrect authorization (CWE-863). The issue is resolved in versions 3.4.12 and 4.15.2.

## Affected products

- ZITADEL ZITADEL < 3.4.12, >= 4.0.0-rc.1, < 4.15.2

## Identifiers

- CVE-2026-55672
- GHSA-xqxv-4jc2-x56x
- GO-2026-5768

## Timeline

- 2026-06-17: patched: Fixes committed and released in versions 3.4.12 and 4.15.2
- 2026-07-10: disclosed: CVE published to NVD

## References

- [https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71](https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71)
- [https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917](https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917)
- [https://github.com/zitadel/zitadel/releases/tag/v3.4.12](https://github.com/zitadel/zitadel/releases/tag/v3.4.12)
- [https://github.com/zitadel/zitadel/releases/tag/v4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)
- [https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x](https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)