{"vulnerability": "GHSA-vrh8-c9cm-wh8v", "sightings": [{"uuid": "6d9d0041-3fbe-48cf-986c-dfbffd225c78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vrh8-c9cm-wh8v", "type": "seen", "source": "https://gist.github.com/alon710/5201f77ce91c5d1ec9edcecc53a2d050", "content": "# CVE-2026-56668: CVE-2026-56668: Privilege Escalation and Cross-Client Audience Bypass in ZITADEL OAuth2 Token Exchange\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56668\n\n## Summary\nA security vulnerability in ZITADEL's backend implementation of the OAuth2 Token Exchange endpoint allows authenticated clients to perform scope escalation and cross-client audience bypass. Prior to version 4.15.3, the Token Exchange flow lacked crucial validation logic, enabling low-privilege tokens to be exchanged for high-privilege tokens or tokens valid within other client applications, violating the OAuth2 delegation model.\n\n## TL;DR\nZITADEL prior to v4.15.3 fails to validate that a subject token belongs to the requesting client or client project, and fails to ensure requested scopes are a subset of the original token scopes. This allows attackers to escalate privileges or bypass cross-client audience boundaries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 8.1\n- **EPSS Score**: 0.00413 (Percentile: 34.75%)\n- **Impact**: Privilege Escalation & Audience Bypass\n- **Exploit Status**: Proof of Concept available in tests\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- ZITADEL OIDC backend package (OAuth2 Token Exchange Flow)\n- **ZITADEL**: < 4.15.3 (Fixed in: `4.15.3`)\n\n## Mitigation\n\n- Upgrade ZITADEL deployments to version 4.15.3 or higher immediately.\n- Review historical logs for suspicious token exchange requests involving mismatched client IDs and escalated scopes.\n\n**Remediation Steps:**\n1. Identify all running instances of ZITADEL in the environment.\n2. Update the container images or binaries to version 4.15.3.\n3. Verify the deployment by executing a test token exchange with an invalid scope to ensure it is rejected with an invalid_scope error.\n4. Monitor authorization server logs for the specific error codes OIDC-zi9Y0 and invalid_scope.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrh8-c9cm-wh8v](https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v)\n- [CVE-2026-56668 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-56668)\n- [CVE-2026-56668 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56668)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56668) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-14T23:32:13.151595Z"}, {"uuid": "643bacc1-f737-4333-a3d7-533872eaf517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vrh8-c9cm-wh8v", "type": "seen", "source": "https://gist.github.com/alon710/5201f77ce91c5d1ec9edcecc53a2d050", "content": "# CVE-2026-56668: CVE-2026-56668: Privilege Escalation and Cross-Client Audience Bypass in ZITADEL OAuth2 Token Exchange\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56668\n\n## Summary\nA security vulnerability in ZITADEL's backend implementation of the OAuth2 Token Exchange endpoint allows authenticated clients to perform scope escalation and cross-client audience bypass. Prior to version 4.15.3, the Token Exchange flow lacked crucial validation logic, enabling low-privilege tokens to be exchanged for high-privilege tokens or tokens valid within other client applications, violating the OAuth2 delegation model.\n\n## TL;DR\nZITADEL prior to v4.15.3 fails to validate that a subject token belongs to the requesting client or client project, and fails to ensure requested scopes are a subset of the original token scopes. This allows attackers to escalate privileges or bypass cross-client audience boundaries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 8.1\n- **EPSS Score**: 0.00413 (Percentile: 34.75%)\n- **Impact**: Privilege Escalation & Audience Bypass\n- **Exploit Status**: Proof of Concept available in tests\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- ZITADEL OIDC backend package (OAuth2 Token Exchange Flow)\n- **ZITADEL**: < 4.15.3 (Fixed in: `4.15.3`)\n\n## Mitigation\n\n- Upgrade ZITADEL deployments to version 4.15.3 or higher immediately.\n- Review historical logs for suspicious token exchange requests involving mismatched client IDs and escalated scopes.\n\n**Remediation Steps:**\n1. Identify all running instances of ZITADEL in the environment.\n2. Update the container images or binaries to version 4.15.3.\n3. Verify the deployment by executing a test token exchange with an invalid scope to ensure it is rejected with an invalid_scope error.\n4. Monitor authorization server logs for the specific error codes OIDC-zi9Y0 and invalid_scope.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrh8-c9cm-wh8v](https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v)\n- [CVE-2026-56668 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-56668)\n- [CVE-2026-56668 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56668)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56668) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-15T00:00:09.404261Z"}]}