vulnerability / NVI-00016375 / Revision 1
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
GitHub lists this reviewed advisory for github.com/zitadel/zitadel, github.com/zitadel/zitadel. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
4.2 medium
GitHub source severity; exploitability and local consequence require separate evidence.
As of · GitHub Advisory Database
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
github.com/zitadel/zitadel
source listed>= 4.0.0-rc.1, < 4.15.2
### Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation Specifically, within the validation pipeline, if an incoming JWT omits the `exp` claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever. Per the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity. ### Impact An attacker in possession of a token lacking an `exp` claim holds a permanent credential with no automatic expiration or revocation window. ### Affected Versions Systems running one of the following versions are affected: * **4.x**: `4.0.0` through `4.15.1` (including RC versions) * **3.x**: `3.0.0` through `3.4.11` (including RC versions) ### Patches The vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `exp` claim. * **4.x**: Upgrade to $\ge$ 4.15.2 * **3.x**: Upgrade to $\ge$ [3.4.12](https
github.com/zitadel/zitadel
source listed< 3.4.12
### Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation Specifically, within the validation pipeline, if an incoming JWT omits the `exp` claim entirely, the expiration block is silently skipped rather than rejected. The token is treated as valid forever. Per the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity. ### Impact An attacker in possession of a token lacking an `exp` claim holds a permanent credential with no automatic expiration or revocation window. ### Affected Versions Systems running one of the following versions are affected: * **4.x**: `4.0.0` through `4.15.1` (including RC versions) * **3.x**: `3.0.0` through `3.4.11` (including RC versions) ### Patches The vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `exp` claim. * **4.x**: Upgrade to $\ge$ 4.15.2 * **3.x**: Upgrade to $\ge$ [3.4.12](https
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-v77h-2w3m-94hx ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.