Junglewise Threat Intelligence

CVE-2026-56664: ZITADEL insufficient session expiration in JWT Identity Provider

CVE-2026-56664 · Severity: medium · CVSS 4.2 · Published 2026-07-10

Technologies: ZITADEL, github.com/zitadel/zitadel (Go). Vendors: ZITADEL, Go.

Executive brief

ZITADEL is an open-source identity management platform used to manage user authentication and access control. A security flaw in how it handles external login providers allows the system to accept expired or arbitrarily old security tokens if they are missing specific timestamp information. This could allow an attacker with an old, stolen token to bypass session expiration rules and maintain unauthorized access to protected resources.

Technical details

A vulnerability in ZITADEL's external JWT Identity Provider (IdP) implementation, specifically within `internal/idp/providers/jwt/session.go`, leads to insufficient session expiration. The system normally enforces a 1-hour maximum token age; however, this check is bypassed if the incoming JWT omits the `iat` (issued-at) claim. An attacker with a low-privileged account or access to a stale token can exploit this to bypass temporal authentication constraints. The issue is fixed in versions 3.4.12 and 4.15.2 by requiring the presence of both `iat` and `exp` claims for successful validation.

Affected products

  • ZITADEL ZITADEL >= 4.0.0, < 4.15.2; < 3.4.12

Timeline

  • 2026-06-17: patched: Fixes released in versions 3.4.12 and 4.15.2
  • 2026-06-17: advisory: GitHub Security Advisory GHSA-wxg7-w2v3-w38g published
  • 2026-07-10: disclosed: CVE-2026-56664 published to NVD

References

Related threats