CVE-2026-56664: ZITADEL insufficient session expiration in JWT Identity Provider

CVE-2026-56664 · Severity: medium · CVSS 4.2 · Published 2026-07-10

ZITADEL is an open-source identity management platform used to manage user authentication and access control. A security flaw in how it handles external login providers allows the system to accept expired or arbitrarily old security tokens if they are missing specific timestamp information. This could allow an attacker with an old, stolen token to bypass session expiration rules and maintain unauthorized access to protected resources.

Technologies: github.com/zitadel/zitadel (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2026-56664 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56664 being exploited in the wild.
How severe is CVE-2026-56664?
Medium severity, with a CVSS score of 4.2, published 10 July 2026.
Which products and versions are affected?
github.com/zitadel/zitadel (Go) SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260615122908-fad02c6d9f45; ZITADEL >= 4.0.0, < 4.15.2; < 3.4.12.
Is there a fix for CVE-2026-56664?
Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615122908-fad02c6d9f45 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56664 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56664?
Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615122908-fad02c6d9f45 or later
    go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260615122908-fad02c6d9f45

Technical details

A vulnerability in ZITADEL's external JWT Identity Provider (IdP) implementation, specifically within `internal/idp/providers/jwt/session.go`, leads to insufficient session expiration. The system normally enforces a 1-hour maximum token age; however, this check is bypassed if the incoming JWT omits the `iat` (issued-at) claim. An attacker with a low-privileged account or access to a stale token can exploit this to bypass temporal authentication constraints. The issue is fixed in versions 3.4.12 and 4.15.2 by requiring the presence of both `iat` and `exp` claims for successful validation.

Affected products

  • ZITADEL ZITADEL >= 4.0.0, < 4.15.2; < 3.4.12

Identifiers

  • CVE-2026-56664
  • GHSA-wxg7-w2v3-w38g
  • GO-2026-5732

Timeline

  • 2026-06-17: patched: Fixes released in versions 3.4.12 and 4.15.2
  • 2026-06-17: advisory: GitHub Security Advisory GHSA-wxg7-w2v3-w38g published
  • 2026-07-10: disclosed: CVE-2026-56664 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.