Security Advisory

CVE-2026-56664

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-10 17:21:22

Last updated 2026-07-10 18:01:25

Assigner GitHub_M

CVSS score 4.2

State PUBLISHED

Description

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication. This issue is fixed in versions 3.4.12 and 4.15.2.

← Browse all CVEs View on cve.org ↗