Executive brief
ZITADEL is an open-source identity and access management (IAM) platform that manages user authentication and authorization. A vulnerability in its OAuth2 Token Exchange feature allows an authenticated user or application to exchange a low-privilege access token for one with elevated permissions at a different application, bypassing the platform's authorization policies. An attacker could gain administrative access, read sensitive user data, or compromise multiple applications within the ZITADEL system.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the OAuth2 Token Exchange endpoint (grant type `urn:ietf:params:oauth:grant-type:token-exchange`). ZITADEL fails to validate that an incoming access token belongs to or is authorized for the client initiating the exchange, and does not enforce that newly requested scopes remain within the boundaries of the original token's scopes. An authenticated attacker can send a token exchange request to a highly-privileged target application, exchanging their low-privilege token for one with administrative rights. The attack requires only low privilege level and network access; user interaction is not needed. Public clients (which require no client secret) make the attack significantly easier. Patches are available in version 4.15.3 for both 4.x and 3.x branches; the fix implements strict audience ownership verification and scope restriction enforcement.
Affected products
- ZITADEL ZITADEL 4.0.0 through 4.15.2, 3.0.0 through 3.4.12
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: Patch released as v4.15.3
- 2026-09-14: advisory