{"items":[{"id":"NVI-00014043","kind":"vulnerability","title":"ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vrh8-c9cm-wh8v","CVE-2026-56668"],"plain_summary":"GitHub lists this reviewed advisory for github.com/zitadel/zitadel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-377b0116ae44b6d3be76207f7a59ebd4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-14T21:28:24.000Z","value":"8.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-377b0116ae44b6d3be76207f7a59ebd4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-377b0116ae44b6d3be76207f7a59ebd4","url":"https://github.com/advisories/GHSA-vrh8-c9cm-wh8v","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vrh8-c9cm-wh8v","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T19:09:30.244Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-377b0116ae44b6d3be76207f7a59ebd4"],"technology":"github.com/zitadel/zitadel","known_exclusions":[],"conditions_summary":"### Summary\n\nA vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies configured within ZITADEL.\n\n### Impact\n\nZITADEL enables administrators to restrict token issuance based on client permissions, project roles, and specific scopes. Due to a missing verification step during the Token Exchange flow (`urn:ietf:params:oauth:grant-type:token-exchange`), ZITADEL fails to validate whether the incoming access token belongs to or is authorized for the client initiating the exchange. Additionally, ZITADEL does not enforce that the newly requested scopes must stay within the boundaries of the original token's scopes.\n\nAn attacker with valid access to a low-privilege application can exploit this behavior by sending a token exchange request to a highly-privileged target application. This allows them to obtain administrative project roles, access sensitive profile data, or gain unauthorized access to other applications across the system. If public clients (which do not requ","public_affected_ranges":["< 4.15.3"]}],"null_published_at":"2026-11-02T10:00:37.200Z","source_updated_at":"2026-09-14T21:28:24.000Z","source_disclosed_at":"2026-09-14T21:28:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T19:09:30.244Z"}],"next_cursor":null,"snapshot_revision":"42594"}