CVE-2026-56665: Logical Validation Bypass in ZITADEL External JWT Identity Provider
Vulnerability ID: CVE-2026-56665
CVSS Score: 4.2
Published: 2026-09-11
A logical verification flaw in ZITADEL's external JWT Identity Provider validation allows attackers to bypass session expiration checks. If an incoming JWT lacks the 'exp' claim, the system skips validation entirely, creating an indefinitely valid session. This issue has been addressed in versions 3.4.12 and 4.15.2.
TL;DR
ZITADEL failed to enforce expiration checks when incoming JWTs lacked the 'exp' claim, allowing indefinite session validity and potential hijacking.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-613
- Attack Vector: Network
- CVSS v3.1 Score: 4.2
- EPSS Score: 0.00266 (Percentile: 18.42%)
- Exploit Status: Proof of Concept
- CISA KEV Status: Not Listed
- Affected Component: internal/idp/providers/jwt/session.go
Affected Systems
- ZITADEL Identity Platform
- ZITADEL Chainguard Images
-
ZITADEL: >= 3.0.0-rc.1, < 3.4.12 (Fixed in:
3.4.12) -
ZITADEL: >= 4.0.0-rc.1, < 4.15.2 (Fixed in:
4.15.2)
Code Analysis
Commit: 4925fab
ZITADEL Core Fix Commit - Cherry Pick 1: Removes IsZero conditional guards on temporal validation checks inside JWT validation session logic.
Commit: d1c3aa8
ZITADEL Core Fix Commit - Cherry Pick 2: Structural validation enforcement and updates to the internal/idp unit tests.
Exploit Details
- GitHub: ZITADEL Official Security Advisory with PoC test definitions.
Mitigation Strategies
- Upgrade ZITADEL instances to versions 3.4.12 or 4.15.2 or later.
- Enforce mandatory 'exp' and 'iat' claims at the trusted external Identity Provider level.
- Implement gateway-level validation rules to discard claims-deficient JSON Web Tokens.
Remediation Steps:
- Identify all ZITADEL deployments utilizing external JWT identity federation.
- Apply the patch release 3.4.12 or 4.15.2 depending on the major version line.
- Verify the update by testing logins with tokens missing the expiration claim to ensure they are rejected.
- Audit active sessions for abnormally long survival times.
References
Read the full report for CVE-2026-56665 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)