EUVD-2026-42958
GHSA-g5h5-m4hm-xjrr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint, but AC:H captures the rare cross-service topology prerequisite; PR:L because attacker must be authenticated to a co-tenant service on the shared IdP.
Primary rating from Vendor (https://github.com/zitadel/zitadel).
CVSS VectorVendor: https://github.com/zitadel/zitadel
Lifecycle Timeline
3DescriptionCVE.org
Summary
An authentication bypass vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation.
When validating JSON Web Tokens (JWTs) from an external provider, ZITADEL properly checks the token's cryptographic signature and issuer (iss), but it fails to validate the audience (aud) claim.
As a result, any validly signed token from the trusted issuer will be accepted. An attacker who is a legitimate user of a completely separate service sharing the same enterprise Identity Provider can intercept or present their token for that service to ZITADEL, successfully authenticating as that user without authorization.
Impact
In a controlled enterprise environment where Identity Providers are explicitly managed, the operational risk is localized. Exploitation requires that an attacker already possesses a valid standard user session token from a shared, trusted issuer intended for an entirely different relying party, limiting the vector to specific, rare cross-service setups where trust boundaries overlap.
Affected Versions
Systems running one of the following versions are affected:
- 4.x:
4.0.0through4.11.0(including RC versions) - 3.x:
3.0.0through3.4.11(including RC versions)
Patches
The vulnerability has been addressed in the latest releases, where a required audience can be set in the IdP configuration. Once provided, audience validation will be enforced.
Workarounds
The recommended solution is to update ZITADEL to a patched version.
If an immediate upgrade is not possible, you can mitigate the risk at the infrastructure layer:
- At the IdP: Ensure the external Identity Provider issues scoped tokens with highly unique, non-overlapping audience values that cannot be misconstrued by separate service deployments.
- At the Perimeter: Deploy a reverse proxy, API gateway, or Web Application Firewall (WAF) layer in front of ZITADEL to inspect incoming identity tokens and explicitly drop requests where the
audfield does not strictly match ZITADEL's deployment target.
Questions
If you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)
Credits
Thanks to Android-Login-Analysis, Jason Zhou and Pedro Giglioti for reporting this vulnerability.
AnalysisAI
Authentication bypass in ZITADEL's external JWT Identity Provider allows a legitimate user of a co-tenant service sharing the same enterprise IdP to authenticate to ZITADEL using a token issued for a different relying party. Affected versions span ZITADEL 3.0.0-3.4.11 and 4.0.0-4.11.0; the flaw arises because ZITADEL correctly validates the JWT cryptographic signature and iss claim but entirely omits validation of the aud claim, violating RFC 7519 audience binding semantics. No public exploit has been identified at time of analysis, and exploitation is tightly constrained to specific enterprise topologies where multiple services share a single trusted IdP.
Technical ContextAI
ZITADEL is an open-source identity and access management platform written in Go (CPE: pkg:go/github.com/zitadel/zitadel). Its external JWT IdP feature allows enterprise deployments to federate authentication by accepting JWTs from an existing upstream Identity Provider. RFC 7519 defines the aud claim as the authoritative binding between a token and its intended recipient; failing to validate it constitutes CWE-346 (Origin Validation Error), allowing tokens scoped to any relying party registered with the same issuer to be accepted. The patch commit d184e976fc79 confirms the root cause: a new audience field was added to the JWT IdP domain struct, a database migration (step 71, SQL: ALTER TABLE projections.idp_templates6_jwt ADD COLUMN audience text) was introduced to store it, and enforcement logic was wired into the JWT validation path. The Angular console UI was also updated to expose the new optional audience configuration field to administrators.
RemediationAI
Vendor-released patches are available: upgrade ZITADEL 3.x deployments to version 3.4.12 or later (https://github.com/zitadel/zitadel/releases/tag/v3.4.12) and ZITADEL 4.x deployments to version 4.15.2 or later (https://github.com/zitadel/zitadel/releases/tag/v4.15.2). After upgrading, administrators must explicitly configure the audience field in each JWT IdP configuration to enforce validation - the patch makes the field available but does not retroactively enforce it on existing configurations without administrator action. If an immediate upgrade is not feasible, two compensating controls can reduce exposure: at the upstream IdP layer, configure the external Identity Provider to issue tokens with unique, non-overlapping audience values per relying party so that tokens issued for other services cannot be misconstrued as ZITADEL-bound - this requires control over the upstream IdP and may not be immediately actionable; at the perimeter, deploy a reverse proxy or WAF in front of ZITADEL to inspect the aud claim in incoming identity tokens and reject requests where the audience does not strictly match ZITADEL's deployment target - this requires TLS inspection capability and adds operational complexity but provides an independent enforcement boundary.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today