What is the CVSS score of CVE-2026-56664?

CVE-2026-56664 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-56664?

Yes, a patch is available for CVE-2026-56664. Update the affected software to the latest version immediately.

ZITADEL CVE-2026-56664

EUVD-2026-42962 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-07-10 GitHub_M

Information Disclosure Zitadel

4.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

Requires external JWT IdP configured and token without iat from trusted issuer (AC:H, PR:L); limited C/I impact bounded by token scope; no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 19:01 EUVD

Analysis Generated

Jul 10, 2026 - 18:39 vuln.today

DescriptionCVE.org

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication. This issue is fixed in versions 3.4.12 and 4.15.2.

AnalysisAI

Insufficient session expiration in ZITADEL's external JWT Identity Provider allows arbitrarily old tokens from trusted issuers to pass authentication when the token omits the iat (issued-at) claim. ZITADEL versions prior to 3.4.12 (v3 branch) and 4.15.2 (v4 branch) are affected. An attacker holding a previously issued JWT from a trusted external IdP - specifically one lacking the iat claim - can reuse that token indefinitely, bypassing intended session expiry controls and maintaining unauthorized access. No public exploit identified at time of analysis.

Technical ContextAI

ZITADEL is an open-source identity and access management platform that supports federated authentication via external JWT Identity Providers. The vulnerable code resides in internal/idp/providers/jwt/session.go, where the token validation logic conditionally evaluates the maximum token age (freshness) check only when the iat (issued-at) JWT claim is present. When an incoming token omits iat, the conditional branch is skipped entirely, violating the intended expiry enforcement. This is classified under CWE-613 (Insufficient Session Expiration): the system fails to reject tokens that exceed the permitted age because it cannot perform the check without the reference timestamp. The affected CPE is cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:* across both major release branches. The trust relationship with the external issuer is preserved - the vulnerability does not break signature verification, only temporal validity enforcement.

RemediationAI

Upgrade to ZITADEL v3.4.12 (v3 branch) or v4.15.2 (v4 branch), both confirmed by vendor release tags at https://github.com/zitadel/zitadel/releases/tag/v3.4.12 and https://github.com/zitadel/zitadel/releases/tag/v4.15.2, with underlying fixes in commits 4925fab849d39a88674485d937b79e54318b48a8 and d1c3aa84af8fcb0f33910ada30b866f4afb551ac. If immediate patching is not feasible, a targeted compensating control is to enforce iat claim inclusion at the external JWT Identity Provider level - configure the issuer to always emit iat so ZITADEL's existing freshness check is never bypassed; this eliminates the vulnerable code path without requiring a ZITADEL upgrade. Alternatively, temporarily disabling the external JWT IdP integration removes the attack surface entirely, at the cost of breaking federated authentication for users of that provider until patching is complete.