{"uuid": "9102db34-530d-4cb2-b143-135c8d352720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56665", "type": "seen", "source": "https://gist.github.com/alon710/238c8eedad7470353ae0c3d6c2eceacc", "content": "# CVE-2026-56665: CVE-2026-56665: Logical Validation Bypass in ZITADEL External JWT Identity Provider\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56665\n\n## Summary\nA logical verification flaw in ZITADEL's external JWT Identity Provider validation allows attackers to bypass session expiration checks. If an incoming JWT lacks the 'exp' claim, the system skips validation entirely, creating an indefinitely valid session. This issue has been addressed in versions 3.4.12 and 4.15.2.\n\n## TL;DR\nZITADEL failed to enforce expiration checks when incoming JWTs lacked the 'exp' claim, allowing indefinite session validity and potential hijacking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-613\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.2\n- **EPSS Score**: 0.00266 (Percentile: 18.42%)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n- **Affected Component**: internal/idp/providers/jwt/session.go\n\n## Affected Systems\n\n- ZITADEL Identity Platform\n- ZITADEL Chainguard Images\n- **ZITADEL**: >= 3.0.0-rc.1, < 3.4.12 (Fixed in: `3.4.12`)\n- **ZITADEL**: >= 4.0.0-rc.1, < 4.15.2 (Fixed in: `4.15.2`)\n\n## Mitigation\n\n- Upgrade ZITADEL instances to versions 3.4.12 or 4.15.2 or later.\n- Enforce mandatory 'exp' and 'iat' claims at the trusted external Identity Provider level.\n- Implement gateway-level validation rules to discard claims-deficient JSON Web Tokens.\n\n**Remediation Steps:**\n1. Identify all ZITADEL deployments utilizing external JWT identity federation.\n2. Apply the patch release 3.4.12 or 4.15.2 depending on the major version line.\n3. Verify the update by testing logins with tokens missing the expiration claim to ensure they are rejected.\n4. Audit active sessions for abnormally long survival times.\n\n## References\n\n- [GHSA-v77h-2w3m-94hx Security Advisory](https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx)\n- [NVD - CVE-2026-56665](https://nvd.nist.gov/vuln/detail/CVE-2026-56665)\n- [CVE Org Portal - CVE-2026-56665](https://www.cve.org/CVERecord?id=CVE-2026-56665)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56665) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T02:32:49.731166Z"}