MEDIUM 4.2 GitHub
CVE-2026-56665
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
### Summary
A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation
Specifically, within the validation pipeline, if an incoming JWT omits the `exp` claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever.
Per the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens
Affected Products
- go/github.com/zitadel/zitadel >= 4.0.0-rc.1, < 4.15.2
- go/github.com/zitadel/zitadel < 3.4.12
References
- https://github.com/advisories/GHSA-v77h-2w3m-94hx
- https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56665
- https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8
This medium severity vulnerability with a CVSS score of 4.2 was published on 2026-09-11 via GitHub. Affected: go/github.com/zitadel/zitadel >= 4.0.0-rc.1, < 4.15.2, go/github.com/zitadel/zitadel < 3.4.12.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.