What is the CVSS score of CVE-2026-56668?

CVE-2026-56668 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of ZITADEL are affected by CVE-2026-56668?

ZITADEL identity platform versions prior to 4.15.3 allow any authenticated user with a low-privilege OAuth2 token to escalate permissions across connected applications by exploiting improper…. A patch is available.

How to fix or mitigate CVE-2026-56668?

Within 24 hours: Enumerate all ZITADEL deployments and document current versions. Within 7 days: Upgrade all instances to ZITADEL 4.15.3 or later; prioritize production environments. Within 30 days: Review token-exchange audit logs for scope violations or cross-application permission grants issued prior to upgrade; reset credentials for any users who escalated privileges during the exposure window.

ZITADEL CVE-2026-56668

EUVD-2026-42967 HIGH

Missing Authorization (CWE-862)

2026-07-10 GitHub_M

GHSA-vrh8-c9cm-wh8v

Authentication Bypass Microsoft Zitadel

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable token endpoint (AV:N/AC:L); a valid low-scope token is required so PR:L not PR:N; escalation yields high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 19:01 EUVD

Analysis Generated

Jul 10, 2026 - 18:22 vuln.today

CVE Published

Jul 10, 2026 - 17:46 cve.org

HIGH 8.1

DescriptionCVE.org

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.

AnalysisAI

Privilege escalation in ZITADEL identity platform (before 4.15.3) allows an attacker holding a low-privilege OAuth2 token to exchange it for elevated permissions at a different application, because the token-exchange endpoint fails to bind the subject token to the requesting client and does not constrain requested scopes to the original token's scopes. Any authenticated principal with a valid low-scope token can escalate laterally across relying applications; no public exploit is identified at time of analysis and it is not listed in CISA KEV. A vendor patch (4.15.3) and fixing commit are available.

Technical ContextAI

The flaw lives in ZITADEL's implementation of the OAuth2 Token Exchange grant (urn:ietf:params:oauth:grant-type:token-exchange, RFC 8693), an authorization-server flow meant to swap one token for another under controlled conditions. A correct implementation must validate that the presented subject_token was issued to or is authorized for the requesting client, and must ensure any newly requested scopes are a subset of the subject token's granted scopes. ZITADEL omitted both checks, which maps to CWE-862 (Missing Authorization): the server mints a new, more privileged token without confirming the requester is entitled to the subject token or the elevated scopes. The affected component is the ZITADEL authorization server itself (cpe:2.3:a:zitadel:zitadel), so every application that delegates authentication and authorization to a vulnerable instance inherits the exposure.

RemediationAI

Vendor-released patch: upgrade ZITADEL to version 4.15.3 or later, which restores the missing checks so the token-exchange endpoint verifies the subject token belongs to the requesting client and confines requested scopes to the original token's scopes (release: https://github.com/zitadel/zitadel/releases/tag/v4.15.3; advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v). If immediate upgrade is not possible, the most effective compensating control is to disable the OAuth2 token-exchange grant (urn:ietf:params:oauth:grant-type:token-exchange) or restrict which clients may invoke it at the gateway, accepting that any legitimate token-exchange integrations will break until re-enabled; additionally audit issued tokens and application grants for anomalous scope elevation and minimize cross-application scope overlap to reduce blast radius. No configuration-only workaround is documented to fully close the gap, so upgrading to 4.15.3 remains the authoritative fix.