CVE-2026-55669: ZITADEL Auth Bypass Vulnerability

CVE-2026-55669 Overview

CVE-2026-55669 is an authentication bypass vulnerability in ZITADEL, an open source identity management platform. The external JSON Web Token (JWT) Identity Provider integration validates the token signature and issuer (iss) claim but does not validate the audience (aud) claim. A validly signed token issued by a trusted identity provider for a different relying party is accepted by ZITADEL. This weakness is classified under [CWE-346: Origin Validation Error]. Versions prior to 3.4.12 and 4.15.2 are affected, and the issue is fixed in 3.4.12 and 4.15.2.

Critical Impact
An attacker holding a JWT that was legitimately issued by a trusted issuer for another application can present it to ZITADEL and be authenticated, enabling cross-tenant token replay against the identity platform.

Affected Products

ZITADEL versions prior to 3.4.12
ZITADEL 4.x versions prior to 4.15.2
Deployments using the external JWT Identity Provider feature

Discovery Timeline

2026-07-10 - CVE-2026-55669 published to the National Vulnerability Database
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55669

Vulnerability Analysis

ZITADEL supports federated authentication through an external JWT Identity Provider. When a client presents a JWT, ZITADEL verifies the cryptographic signature against the configured issuer's keys and confirms the iss claim matches the trusted issuer. The verification path omits validation of the aud (audience) claim defined by RFC 7519.

The aud claim identifies the intended recipient of a JWT. Skipping this check breaks the trust boundary between distinct relying parties that share the same issuer. Any application that receives a token signed by the trusted issuer can forward that token to ZITADEL, and ZITADEL will treat it as valid authentication material.

Root Cause

The root cause is incomplete origin validation in the external JWT Identity Provider verification logic. The implementation checks signature and issuer but not audience, violating the standard JWT validation requirements. This maps to [CWE-346: Origin Validation Error].

Attack Vector

Exploitation requires an attacker to already possess a valid JWT issued by the same trusted issuer that ZITADEL is configured to accept. The token can be one legitimately issued to the attacker by a sibling application under that issuer, or a captured token intended for a different relying party. The attacker submits the token to ZITADEL's external JWT authentication endpoint over the network. The attack complexity is elevated because the attacker needs a valid, unexpired signed token from the trusted issuer.

See the GitHub Security Advisory GHSA-g5h5-m4hm-xjrr for the vendor's technical description.

Detection Methods for CVE-2026-55669

Indicators of Compromise

Authentication events in ZITADEL where the JWT aud claim does not reference the ZITADEL relying party identifier.
Successful federated logins originating from users or client IDs that do not exist in the ZITADEL user directory of the expected audience.
Repeated authentication attempts from the same trusted issuer using tokens with varying aud values.

Detection Strategies

Enable verbose logging on the external JWT Identity Provider path and inspect decoded JWT claims for unexpected aud values.
Correlate ZITADEL authentication logs with the upstream identity provider's token issuance logs to detect tokens issued for other clients but consumed by ZITADEL.
Alert on ZITADEL version banners reporting builds older than 3.4.12 or 4.15.2 in the environment.

Monitoring Recommendations

Forward ZITADEL access and audit logs to a centralized SIEM and build detections keyed on JWT audience anomalies.
Monitor the issuer's key rotation events and correlate them with authentication spikes in ZITADEL.
Track configuration changes to the external JWT Identity Provider settings, including issuer URL and claim mappings.

How to Mitigate CVE-2026-55669

Immediate Actions Required

Upgrade ZITADEL to version 3.4.12 or 4.15.2 or later.
Inventory all ZITADEL instances and identify any that use the external JWT Identity Provider feature.
Rotate credentials and review recent federated login events for accounts that may have been accessed with mis-scoped tokens.

Patch Information

The issue is fixed in ZITADEL v3.4.12 and v4.15.2. The patched releases enforce validation of the aud claim against the configured relying party identifier during external JWT verification.

Workarounds

If immediate upgrade is not feasible, disable the external JWT Identity Provider integration until patching is complete.
Restrict issuers configured in ZITADEL so they only sign tokens for ZITADEL as the sole relying party.
Reduce JWT lifetimes at the upstream issuer to shrink the window in which a mis-scoped token can be replayed.

bash

# Verify the running ZITADEL version and upgrade
zitadel --version

# Example container upgrade to a fixed release
docker pull ghcr.io/zitadel/zitadel:v4.15.2
docker stop zitadel && docker rm zitadel
docker run -d --name zitadel ghcr.io/zitadel/zitadel:v4.15.2