CVE-2026-56668: ZITADEL OAuth2 Auth Bypass Vulnerability

CVE-2026-56668 Overview

CVE-2026-56668 is a missing authorization vulnerability [CWE-862] in ZITADEL, an open source identity and access management platform. The flaw resides in the OAuth2 Token Exchange endpoint handling the urn:ietf:params:oauth:grant-type:token-exchange grant type. Prior to version 4.15.3, ZITADEL does not verify that the subject token belongs to the requesting client, nor that the requested scopes remain within the original token's scopes. An authenticated attacker holding a low-privilege token can exchange it for a token with elevated permissions at a different application, breaking the trust boundaries between OAuth clients.

Critical Impact
A low-privileged OAuth token can be exchanged for elevated permissions across applications, enabling privilege escalation and cross-application access in ZITADEL deployments prior to 4.15.3.

Affected Products

ZITADEL identity management platform, all versions prior to 4.15.3
Deployments exposing the OAuth2 Token Exchange endpoint (urn:ietf:params:oauth:grant-type:token-exchange)
Self-hosted and cloud ZITADEL installations serving multiple OAuth clients

Discovery Timeline

2026-07-10 - CVE-2026-56668 published to NVD
2026-07-14 - Last updated in NVD database
v4.15.3 - ZITADEL releases patched version with client and scope validation

Technical Details for CVE-2026-56668

Vulnerability Analysis

The vulnerability affects ZITADEL's implementation of RFC 8693 OAuth 2.0 Token Exchange. When a client submits a token exchange request, the server accepts a subject_token and issues a new access token. The endpoint failed to enforce two authorization checks required by the specification. First, it did not verify that the subject_token was originally issued to (or intended for) the requesting client. Second, it did not confine the requested scope values to the scopes granted in the original token.

An attacker registered as a low-privilege OAuth client can capture or receive a subject token issued for a different audience. The attacker then submits that token to the exchange endpoint from their own client credentials and requests broader scopes. ZITADEL returns a token bound to the attacker's identity with elevated scopes usable at another application, resulting in horizontal and vertical privilege escalation.

Root Cause

The root cause is missing authorization enforcement in the token exchange handler located in internal/api/oidc/token_exchange.go. The code path validated that the subject token was structurally valid but omitted an audience check tying the token to the calling client, and it did not intersect the requested scopes with the subject token's scope set. This maps to [CWE-862] Missing Authorization.

Attack Vector

Exploitation is performed over the network against the OAuth2 token endpoint. The attacker needs valid client credentials (low privilege is sufficient) and access to a subject token issued to a different client. No user interaction is required. The upstream fix introduces validateIntrospectionAudience on the subject token, tying it to the requesting client's project when the token is not a Personal Access Token (PAT).

		if err != nil {
			return nil, zerrors.ThrowPermissionDenied(err, "OIDC-Osh3t", "Errors.TokenExchange.Token.Invalid")
		}
+		if !token.isPAT {
+			if err = validateIntrospectionAudience(token.audience, client.GetID(), client.client.ProjectID); err != nil {
+				return nil, zerrors.ThrowPermissionDenied(err, "OIDC-zi9Y0", "Errors.TokenExchange.Token.Invalid")
+			}
+		}
		if token.isPAT {
			if err = s.assertClientScopesForPAT(ctx, token, client.GetID(), client.client.ProjectID); err != nil {
				return nil, err

Source: ZITADEL commit e2886a6. The patch enforces audience validation on the subject token before completing the exchange.

Detection Methods for CVE-2026-56668

Indicators of Compromise

Token exchange requests where the subject_token audience or azp claim does not match the authenticated client's identifier.
Issuance of access tokens with scopes broader than those present in the original subject token.
Unexpected access token issuance to low-privilege OAuth clients targeting resources associated with other projects.
Repeated calls to the /oauth/v2/token endpoint with grant_type=urn:ietf:params:oauth:grant-type:token-exchange from clients that do not normally use token exchange.

Detection Strategies

Audit ZITADEL OIDC event logs for token.exchanged events and correlate the subject token's original client with the requesting client identifier.
Alert on any token exchange where the resulting token grants scopes outside the union of scopes previously granted to the subject token.
Baseline which clients legitimately use the token exchange grant type and flag deviations.

Monitoring Recommendations

Forward ZITADEL access and admin logs to a centralized log platform and retain them for post-incident review.
Monitor for spikes in permission-denied errors with error codes OIDC-Osh3t and OIDC-zi9Y0 after patching, which indicate blocked exchange attempts.
Track anomalous authentication patterns per OAuth client, including sudden scope elevation or cross-project token issuance.

How to Mitigate CVE-2026-56668

Immediate Actions Required

Upgrade ZITADEL to version 4.15.3 or later, which contains the audience and scope validation fix.
Inventory all registered OAuth clients and identify those with the token exchange grant type enabled.
Rotate client secrets and revoke long-lived access tokens issued before the upgrade if compromise is suspected.
Review recent token exchange activity in audit logs for signs of scope elevation.

Patch Information

The fix is available in ZITADEL release v4.15.3. Technical details are documented in the GitHub Security Advisory GHSA-vrh8-c9cm-wh8v and the upstream commit e2886a6. The patch adds validateIntrospectionAudience checks so the subject token's audience must match the requesting client's project before an exchange succeeds.

Workarounds

Disable the token exchange grant type on OAuth clients that do not require it until patching is complete.
Restrict which clients are permitted to use urn:ietf:params:oauth:grant-type:token-exchange through ZITADEL client configuration.
Reduce access token lifetimes to shrink the window during which a stolen subject token can be exchanged.

bash

# Verify installed ZITADEL version and upgrade to a fixed release
zitadel --version

# Example: pull the patched container image
docker pull ghcr.io/zitadel/zitadel:v4.15.3

# Redeploy using the fixed image, then confirm the token endpoint is served by v4.15.3
curl -s https://<zitadel-host>/debug/ready -o /dev/null -w "%{http_code}\n"