CyberRota Analysis
AI-GeneratedZITADEL's external JWT Identity Provider is vulnerable due to improper handling of token expiration when the exp claim is absent, potentially allowing tokens from trusted issuers to remain valid indefinitely. This flaw could lead to unauthorized access if an attacker exploits the lack of expiration checks. Organizations using ZITADEL versions prior to 3.4.12 and 4.15.2 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips expiration handling when an incoming token omits the exp claim, allowing a token from a trusted issuer to be treated as valid without an automatic expiration window. This issue is fixed in versions 3.4.12 and 4.15.2.