Executive brief
ZITADEL is an open-source identity and access management platform that authenticates users via external JWT identity providers. The platform's JWT validation logic fails to reject tokens missing the required expiration claim, allowing attackers to use forged tokens that never expire. This breaks session lifecycle management and enables persistent unauthorized access to applications relying on ZITADEL for authentication.
Technical details
The vulnerability exists in ZITADEL's JWT IdP provider validation pipeline, where the absence of the `exp` (expiration) claim in an incoming JWT results in the expiration check being silently skipped rather than explicitly rejected. This violates the OIDC Core 1.0 specification, which mandates strict validation of token lifecycle constraints. The flaw affects versions 4.0.0–4.15.1 and 3.0.0–3.4.11. An attacker who controls or compromises an upstream identity provider can issue JWTs without an expiration claim; ZITADEL will accept these indefinitely, granting persistent access. The attack requires low privileges (as an external IdP) and network access but no user interaction. Patches are available in versions 4.15.2 and 3.4.12, which now explicitly reject tokens lacking the `exp` claim.
Affected products
- ZITADEL ZITADEL 4.0.0 through 4.15.1, 3.0.0 through 3.4.11
Timeline
- 2026-06-22: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-06-22: patched: Patches released: v4.15.2 and v3.4.12
- 2026-09-11: advisory: Advisory published in GitHub; separated from GHSA-wxg7-w2v3-w38g for CVE mapping purposes
References
- https://api.github.com/users/Android-Login-Analysis
- https://github.com/Android-Login-Analysis
- https://api.github.com/users/Android-Login-Analysis/gists%7B/gist_id%7D
- https://api.github.com/users/Android-Login-Analysis/repos
- https://avatars.githubusercontent.com/u/43461385?v=4
- https://api.github.com/users/Android-Login-Analysis/events%7B/privacy%7D