CVE-2026-55672 ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
Attackers can exchange intercepted OAuth2 grants or refresh tokens under a different client ID, bypassing authentication checks in ZITADEL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55672?
CVE-2026-55672 is a high-severity authentication bypass vulnerability in zitadel, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.
Which versions are affected by CVE-2026-55672?
3 open source packages ship an affected version, including github.com/zitadel/zitadel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260616131956-0973b074b488 |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260616131956-0973b074b488 |
github.com/zitadel/zitadel Go | All versions | 1.80.0-v2.20.0.20260616131956-0973b074b488 |
How do I fix CVE-2026-55672?
Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-55672 being exploited?
There is no known exploitation of CVE-2026-55672 in the wild and no public exploit code.
Sources
Also known as GHSA-xqxv-4jc2-x56x, GO-2026-5768.