SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-56665

MEDIUM · CVSS 4.2 EPSS 0.17% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-10 · Last synced 2026-08-09

CyberRota Analysis

AI-Generated

ZITADEL's external JWT Identity Provider is vulnerable due to improper handling of token expiration when the exp claim is absent, potentially allowing tokens from trusted issuers to remain valid indefinitely. This flaw could lead to unauthorized access if an attacker exploits the lack of expiration checks. Organizations using ZITADEL versions prior to 3.4.12 and 4.15.2 should prioritize upgrading to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-56665
Severity
MEDIUM
CVSS
4.2
EPSS
0.17%

Original NVD Description

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips expiration handling when an incoming token omits the exp claim, allowing a token from a trusted issuer to be treated as valid without an automatic expiration window. This issue is fixed in versions 3.4.12 and 4.15.2.