CVE-2026-55669: ZITADEL JWT Audience Claim Validation Bypass

Technical summary

ZITADEL's external JWT Identity Provider implementation performs signature validation and issuer (iss) claim verification but omits validation of the audience (aud) claim. This permits token substitution attacks where a validly signed JWT from a trusted issuer, originally issued for a different relying party (aud value), gains acceptance by ZITADEL. The vulnerability is classified under CWE-346 (Origin Validation Error) and requires prior authentication (PR:L in the CVSS vector), meaning an attacker must already possess a valid login context. The issue is fixed in versions 3.4.12 (for the 3.4.x line) and 4.15.2 (for the 4.x line).

Business impact

Organizations running vulnerable ZITADEL versions risk token hijacking within federated identity scenarios. An authenticated user holding a JWT from a trusted external provider could potentially escalate access or assume identities not originally granted to them. The blast radius is narrowed by the authentication requirement but remains concerning in environments with multiple integrated identity providers or third-party SaaS applications sharing a common issuer. Compromised or misconfigured external providers become higher-impact threats. Identity governance and access control reporting may become unreliable if token substitution occurs undetected.

Affected systems

ZITADEL versions prior to 3.4.12 and prior to 4.15.2 are affected. The 3.4.x maintenance line requires upgrade to 3.4.12 or later. The 4.x primary line requires upgrade to 4.15.2 or later. Version 5.x and later are unaffected (verify against the vendor advisory for long-term support and end-of-life timelines). Self-hosted deployments and any managed ZITADEL service using older major versions are in scope.

Exploitability

Exploitation requires an authenticated user with valid credentials to a trusted external identity provider—a relatively high bar compared to unauthenticated attacks. An attacker cannot obtain a JWT out of thin air; they must either control or compromise an account at the external provider or intercept/predict a token in transit. The attack surface is primarily internal or within federated partner networks. The CVSS score of 4.2 (MEDIUM) reflects the authentication prerequisite and limited confidentiality and integrity impact. Real-world exploitability depends on provider hygiene and token exposure controls at the external issuer.

Remediation

Upgrade ZITADEL to version 3.4.12 or later (3.4.x branch) or version 4.15.2 or later (4.x branch). Review the vendor's release notes for any breaking changes or migration steps. After patching, perform a smoke test of external JWT provider integrations to confirm token validation works as expected and no legitimate users are denied access. No configuration changes are required—the fix is automatic upon upgrade.

Patch guidance

Apply updates in a staging environment first to validate compatibility with your external identity provider configurations. Scheduled downtime is typically brief for ZITADEL patches; coordinate with dependent applications. Check the official ZITADEL advisory and release notes at github.com/zitadel/zitadel for detailed upgrade instructions, potential backward compatibility notes, and any database migrations. For organizations on 3.4.x, verify support status before committing to that branch; consider a longer-term upgrade to 4.x. Automate patch management where possible to reduce recurrence of similar issues.

Detection guidance

Monitor ZITADEL logs for JWT validation events, particularly failures or warnings related to token claims. Search for audit logs showing successful logins via external JWT providers with unusual aud claim mismatches if logging is detailed enough. Check for access patterns where a user authenticated via Provider A gains access to resources normally reserved for users of Provider B. Review identity provider integration logs and look for tokens being accepted that do not match the issuer's documented audience configuration. Correlation with failed or suspicious login attempts can help identify probing behavior.

Why prioritize this

Although CVSS is MEDIUM and not on the CISA KEV catalog, the vulnerability directly undermines identity verification integrity—a foundational security control. In zero-trust architectures and environments with multiple federated providers, audience validation is a critical defense. The fix is straightforward and low-risk, making it a high-priority patch from an ease-of-remediation standpoint. Organizations with complex multi-tenant or multi-provider setups should prioritize this within the next 30 days.

Risk score, explained

CVSS 4.2 reflects: (1) Network-accessible attack vector (AV:N), (2) High complexity due to authentication requirement (AC:H), (3) Low privilege needed but logged-in user required (PR:L), (4) Limited confidentiality and integrity impact scoped to the user or resource level (C:L, I:L), (5) No availability impact (A:N). The 'High Complexity' factor acknowledges that the attacker must obtain or control a valid external token; this is not trivial in practice but feasible in social engineering or account compromise scenarios. The rating is appropriate for an identity context where even MEDIUM-severity token validation flaws warrant attention.

Frequently asked questions