OAuth2 Token Exchange Vulnerability in ZITADEL Identity Management Platform
CVE-2026-56668
8.1HIGH
What is CVE-2026-56668?
The ZITADEL Identity Management Platform has a vulnerability related to its OAuth2 Token Exchange endpoint. Prior to version 4.15.3, it does not properly verify that the subject token belongs to the requesting client and fails to ensure that the requested scopes are limited to the original token's scopes. This oversight allows low-privilege tokens to be exchanged for higher permissions within other applications, posing a significant security risk. For mitigation, it is crucial for users to update to version 4.15.3 or later, which addresses this issue.
Affected Version(s)
zitadel < 4.15.3