CyberRota Analysis
AI-GeneratedThe vulnerability affects ZITADEL's OAuth2 and OIDC implementations in versions prior to 3.4.12 and 4.15.2, where the system fails to properly verify client identities during token exchange processes. This flaw can lead to unauthorized access, as intercepted grants or refresh tokens may be exploited by malicious actors to impersonate legitimate clients. Organizations using affected versions of ZITADEL should prioritize upgrading to the patched versions to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.