medium4.2
CVE-2026-55669
ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
Impact
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer (iss) but not the audience (aud) claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted by ZITADEL. This issue is fixed in versions 3.4.12 and 4.15.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/zitadel/zitadel | < 1.80.0-v2.20.0.20260615132747-d184e976fc79 | 1.80.0-v2.20.0.20260615132747-d184e976fc79 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-g5h5-m4hm-xjrr
- https://github.com/zitadel/zitadel/security/advisories/GHSA-g5h5-m4hm-xjrr
- https://github.com/zitadel/zitadel/commit/d184e976fc799a383bb6ef9f32c3bae11a3ef85f
- https://github.com/zitadel/zitadel/releases/tag/v3.4.12
- https://github.com/zitadel/zitadel/releases/tag/v4.15.2