CVE-2026-55672CWE-287CWE-863

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

High · published July 10, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.5th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-863 · Incorrect Authorization
Published
2026-07-10T17:19Z
EPSS history
Timeline
  • 10 JUL 17:19Z
    ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
    cvelistv5