CyberRota Analysis
AI-GeneratedZITADEL's identity management platform is vulnerable due to a flaw in its external JWT Identity Provider validation, which fails to enforce a maximum token age check when the incoming token lacks the 'iat' claim. This oversight allows potentially outdated tokens from trusted issuers to authenticate, posing a risk of unauthorized access. Organizations using versions prior to 3.4.12 and 4.15.2 should prioritize upgrading to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication. This issue is fixed in versions 3.4.12 and 4.15.2.