CVE-2023-22492 RefreshToken invalidation vulnerability
Attackers can obtain valid access tokens using refresh tokens even after user accounts are locked or deactivated, bypassing authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22492?
CVE-2023-22492 is a medium-severity authentication bypass vulnerability in zitadel, published on 11 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration). As a workaround, ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements. This issue has been patched in versions 2.17.3 and 2.16.4.
Weakness: CWE-613
Which versions are affected by CVE-2023-22492?
4 open source packages ship an affected version, including github.com/zitadel/zitadel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | From 2.0.0 | 2.16.4 |
github.com/zitadel/zitadel Go | From 2.0.0 | 2.16.4 |
github.com/zitadel/zitadel Go | From 2.17.0 | 2.17.3 |
github.com/zitadel/zitadel Go | From 2.17.0 | 2.17.3 |
Products include Zitadel Zitadel.
How do I fix CVE-2023-22492?
Upgrade github.com/zitadel/zitadel to a fixed version for your release line: 2.16.4 or 2.17.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-22492 being exploited?
There is no known exploitation of CVE-2023-22492 in the wild and no public exploit code.
Other vulnerabilities in zitadel
- CVE-2026-29191 ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint
- CVE-2025-67494 ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
- CVE-2025-27507 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
- CVE-2025-64103 Zitadel Bypass Second Authentication Factor
- CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants
Sources
Also known as GHSA-6rrr-78xp-5jp8.