{"items":[{"id":"NVI-00016244","kind":"vulnerability","title":" ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wxg7-w2v3-w38g","CVE-2026-56664"],"plain_summary":"GitHub lists this reviewed advisory for github.com/zitadel/zitadel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-53364cea659a7393e3c0b8cf9c8156eb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-18T17:24:11.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-53364cea659a7393e3c0b8cf9c8156eb"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-53364cea659a7393e3c0b8cf9c8156eb","url":"https://github.com/advisories/GHSA-wxg7-w2v3-w38g","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wxg7-w2v3-w38g","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:49:06.528Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-53364cea659a7393e3c0b8cf9c8156eb"],"technology":"github.com/zitadel/zitadel","known_exclusions":[],"conditions_summary":"### Summary\n\nA token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation.\nZITADEL enforces a 1-hour maximum token age freshness window (`maxAge`) calculated from the token's issue time. However, this safety check is guarded by a presence condition. If an incoming token omits the `iat` claim, the freshness check is entirely bypassed, allowing arbitrarily old tokens to pass authentication successfully.\n\nPer the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity.\n\n### Impact\n\nAn attacker in possession of a stale token lacking an `iat` claim can reuse it indefinitely without triggering the maximum age freshness invalidation.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.15.1` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `iat` c","public_affected_ranges":["< 1.80.0-v2.20.0.20260615122908-fad02c6d9f45"]}],"null_published_at":"2026-11-04T10:04:27.922Z","source_updated_at":"2026-07-18T17:24:11.000Z","source_disclosed_at":"2026-06-18T13:52:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:49:06.528Z"}],"next_cursor":null,"snapshot_revision":"42594"}