{"items":[{"id":"NVI-00016375","kind":"vulnerability","title":"ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v77h-2w3m-94hx","CVE-2026-56665"],"plain_summary":"GitHub lists this reviewed advisory for github.com/zitadel/zitadel, github.com/zitadel/zitadel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6c14df57bb01a162777f89d629f1900c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-11T21:32:19.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6c14df57bb01a162777f89d629f1900c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6c14df57bb01a162777f89d629f1900c","url":"https://github.com/advisories/GHSA-v77h-2w3m-94hx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v77h-2w3m-94hx","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:05.264Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6c14df57bb01a162777f89d629f1900c"],"technology":"github.com/zitadel/zitadel","known_exclusions":[],"conditions_summary":"### Summary\n\nA token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation\nSpecifically, within the validation pipeline, if an incoming JWT omits the `exp` claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever.\n\nPer the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity.\n\n### Impact\n\nAn attacker in possession of a token lacking an `exp` claim holds a permanent credential with no automatic expiration or revocation window.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.15.1` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `exp` claim.\n\n* **4.x**: Upgrade to $\\ge$ 4.15.2\n* **3.x**: Upgrade to $\\ge$ [3.4.12](https","public_affected_ranges":[">= 4.0.0-rc.1, < 4.15.2"]},{"certainty":"source_listed","source_ids":["sr-6c14df57bb01a162777f89d629f1900c"],"technology":"github.com/zitadel/zitadel","known_exclusions":[],"conditions_summary":"### Summary\n\nA token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation\nSpecifically, within the validation pipeline, if an incoming JWT omits the `exp` claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever.\n\nPer the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity.\n\n### Impact\n\nAn attacker in possession of a token lacking an `exp` claim holds a permanent credential with no automatic expiration or revocation window.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.15.1` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `exp` claim.\n\n* **4.x**: Upgrade to $\\ge$ 4.15.2\n* **3.x**: Upgrade to $\\ge$ [3.4.12](https","public_affected_ranges":["< 3.4.12"]}],"null_published_at":"2026-11-04T10:04:27.937Z","source_updated_at":"2026-09-11T21:32:19.000Z","source_disclosed_at":"2026-09-11T21:32:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:05.264Z"}],"next_cursor":null,"snapshot_revision":"42594"}