CVE-2026-56664 zitadel CVE debrief

Who should care

Organizations using ZITADEL for identity management should verify their configurations and update to versions 3.4.12 or 4.15.2 to mitigate this vulnerability. Additionally, security teams and vulnerability management teams should review the CVE record and NVD entry to understand the scope of the vulnerability and the fixed versions.

Technical summary

ZITADEL's external JWT Identity Provider validation bypasses the maximum token age freshness check when an incoming token omits the iat claim, allowing old tokens from a trusted issuer to pass authentication. This issue is fixed in versions 3.4.12 and 4.15.2. The vulnerability has a CVSS score of 4.2 and a severity of MEDIUM. The affected product is ZITADEL, and the vulnerability affects its external JWT Identity Provider validation.

Defensive priority

Medium priority due to the potential for authentication bypass.

Recommended defensive actions

• Verify ZITADEL configurations for external JWT Identity Provider validation.
• Update to ZITADEL versions 3.4.12 or 4.15.2.
• Monitor authentication logs for suspicious activity.
• Implement compensating controls for token validation.
• Review CVE record and NVD entry for detailed information.
• Track exceptions and retest remediated assets.
• Check relevant monitoring, detection, and logs for exposed assets.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and fixed versions. Further investigation is needed to determine the full scope of affected systems, including verifying the configurations of ZITADEL's external JWT Identity Provider validation and reviewing authentication logs for suspicious activity. Additionally, defenders should verify the integrity of incoming tokens and ensure that the maximum token age freshness check is properly implemented.

Official resources