What is the CVSS score of CVE-2026-56665?

CVE-2026-56665 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-56665?

Yes, a public proof-of-concept exploit is available for CVE-2026-56665. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-56665?

Yes, a patch is available for CVE-2026-56665. Update the affected software to the latest version immediately.

ZITADEL CVE-2026-56665

EUVD-2026-42963 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-07-10 GitHub_M

GHSA-v77h-2w3m-94hx

Information Disclosure Zitadel

4.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

AC:H reflects the dual prerequisite of an active JWT IdP configuration and a token lacking exp; PR:L reflects required standing in the federated identity flow; C:L/I:L for session persistence abuse with no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 19:01 EUVD

Analysis Generated

Jul 10, 2026 - 18:38 vuln.today

DescriptionCVE.org

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips expiration handling when an incoming token omits the exp claim, allowing a token from a trusted issuer to be treated as valid without an automatic expiration window. This issue is fixed in versions 3.4.12 and 4.15.2.

AnalysisAI

Insufficient JWT expiration enforcement in ZITADEL's external JWT Identity Provider integration allows tokens lacking the exp claim to be treated as indefinitely valid, bypassing intended session lifetime controls. Versions 3.0.0-rc.1 through 3.4.11 and 4.0.0-rc.1 through 4.15.1 are affected, with the flaw residing in internal/idp/providers/jwt/session.go. An attacker who can obtain or craft a JWT from a configured trusted external issuer that omits the exp claim can maintain persistent authenticated access without re-authentication. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

ZITADEL implements an external JWT Identity Provider feature that allows organizations to federate authentication from external issuers using signed JWTs. The JWT specification (RFC 7519) treats the exp (expiration time) claim as optional, but compliant implementations are expected to handle its absence by applying a default expiration policy. The flaw in internal/idp/providers/jwt/session.go skips expiration validation entirely when exp is absent rather than applying a fallback window or rejecting the token. This maps to CWE-613 (Insufficient Session Expiration), where a session credential remains valid beyond its intended lifetime. The affected CPE is cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*, covering both the v3 and v4 release lines. The root cause is a missing defensive check - the code treats an absent exp as equivalent to an always-valid token rather than enforcing a conservative default.

RemediationAI

Upgrade to ZITADEL v3.4.12 (https://github.com/zitadel/zitadel/releases/tag/v3.4.12) or v4.15.2 (https://github.com/zitadel/zitadel/releases/tag/v4.15.2), which contain the upstream fixes in commits 4925fab849d39a88674485d937b79e54318b48a8 and d1c3aa84af8fcb0f33910ada30b866f4afb551ac respectively. If immediate patching is not feasible, the most effective compensating control is to disable the external JWT Identity Provider configuration entirely until the upgrade can be applied - this eliminates the vulnerable code path without affecting other authentication methods. Alternatively, audit the external JWT issuers configured in your ZITADEL instance and ensure those issuers are hardened to always include the exp claim in emitted tokens; however, this depends on operator control over the external IdP and cannot be enforced at the ZITADEL layer on unpatched versions. Do not rely on network-layer controls alone, as the vulnerable endpoint is legitimately exposed to authenticated users.