# CVE-2026-56664: ZITADEL insufficient session expiration in JWT Identity Provider

Source: https://junglewise.ai/threats/cve-2026-56664-zitadel-insufficient-session-expiration-in-jwt-identity-provider  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-56664 · Severity: medium · CVSS 4.2 · Published 2026-07-10

ZITADEL is an open-source identity management platform used to manage user authentication and access control. A security flaw in how it handles external login providers allows the system to accept expired or arbitrarily old security tokens if they are missing specific timestamp information. This could allow an attacker with an old, stolen token to bypass session expiration rules and maintain unauthorized access to protected resources.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel), [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-56664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56664 being exploited in the wild.

**How severe is CVE-2026-56664?** Medium severity, with a CVSS score of 4.2, published 10 July 2026.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) SEMVER:introduced=0,fixed=1.80.0-v2.20.0.20260615122908-fad02c6d9f45; ZITADEL >= 4.0.0, < 4.15.2; < 3.4.12.

**Is there a fix for CVE-2026-56664?** Yes. github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615122908-fad02c6d9f45 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56664 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-56664?** Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zitadel/zitadel (Go): upgrade to 1.80.0-v2.20.0.20260615122908-fad02c6d9f45 or later

  ```sh
  go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260615122908-fad02c6d9f45
  ```


## Technical details

A vulnerability in ZITADEL's external JWT Identity Provider (IdP) implementation, specifically within `internal/idp/providers/jwt/session.go`, leads to insufficient session expiration. The system normally enforces a 1-hour maximum token age; however, this check is bypassed if the incoming JWT omits the `iat` (issued-at) claim. An attacker with a low-privileged account or access to a stale token can exploit this to bypass temporal authentication constraints. The issue is fixed in versions 3.4.12 and 4.15.2 by requiring the presence of both `iat` and `exp` claims for successful validation.

## Affected products

- ZITADEL ZITADEL >= 4.0.0, < 4.15.2; < 3.4.12

## Identifiers

- CVE-2026-56664
- GHSA-wxg7-w2v3-w38g
- GO-2026-5732

## Timeline

- 2026-06-17: patched: Fixes released in versions 3.4.12 and 4.15.2
- 2026-06-17: advisory: GitHub Security Advisory GHSA-wxg7-w2v3-w38g published
- 2026-07-10: disclosed: CVE-2026-56664 published to NVD

## References

- [https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8](https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8)
- [https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac](https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac)
- [https://github.com/zitadel/zitadel/releases/tag/v3.4.12](https://github.com/zitadel/zitadel/releases/tag/v3.4.12)
- [https://github.com/zitadel/zitadel/releases/tag/v4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)
- [https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g](https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)