CVE-2026-56664Medium· 4.2▾ SunlitZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Two closely related token lifecycle validation vulnerabilities were discovered in ZITADEL's external JWT Identity Provider (IdP) implementation.
Specifically, within the validation pipeline:
exp) Enforcement: If an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever.iat) Enforcement: ZITADEL enforces a 1-hour freshness window (maxAge) via the token's issue time. However, this safety check is guarded by a presence condition. If a token omits the iat claim, the freshness check is entirely bypassed, allowing arbitrarily old tokens to pass.Per the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity.
An attacker in possession of a token that lacks both exp and iat claims holds a permanent credential that will never expire and will always be deemed "fresh" by the system. Even without combining both flaws, the absence of an expiration constraint means a leaked token effectively turns into a skeleton key for that user session with no automatic revocation window.
Systems running one of the following versions are affected:
4.0.0 through 4.15.1 (including RC versions)3.0.0 through 3.4.11 (including RC versions)The vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an exp or iat claim.
The recommended solution is to update ZITADEL to a patched version.
If an immediate upgrade is not feasible, ensure at the Identity Provider level that the external IdP is rigidly configured to enforce short token lifetimes and explicitly includes both exp and iat claims in every single token payload it signs and issues.
If you have any questions or comments about this advisory, please email us at [email protected]
Thanks to Android-Login-Analysis, Jason Zhou and Pedro Giglioti for reporting this vulnerability.
github.com/zitadel/zitadel < 1.80.0-v2.20.0.20260615122908-fad02c6d9f45Upgrade to a patched release:
github.com/zitadel/zitadel 1.80.0-v2.20.0.20260615122908-fad02c6d9f45Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56665Medium· 4.2ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
GHSA-wxg7-w2v3-w38gMedium· 4.2ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
CVE-2026-55672High· 7.4ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
CVE-2026-55669Medium· 4.2ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
CVE-2026-56668High· 8.1ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
CVE-2026-76081Medium· 5.5ZITADEL is an open source identity management platform