Beveiligingsadvies

CVE-2026-56664

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-10 17:21:22

Laatst bijgewerkt 2026-07-10 18:01:25

Toegewezen door GitHub_M

CVSS-score 4.2

Status PUBLISHED

Beschrijving

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication. This issue is fixed in versions 3.4.12 and 4.15.2.

← Alle CVE's bekijken Bekijk op cve.org ↗