CVE-2026-56668 ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
Attackers can exchange low-privilege tokens for elevated permissions in other applications due to missing validation in ZITADEL's OAuth2 token exchange endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56668?
CVE-2026-56668 is a high-severity vulnerability in zitadel, published on 10 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.
Weakness: CWE-862
Which versions are affected by CVE-2026-56668?
3 open source packages ship an affected version, including github.com/zitadel/zitadel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/zitadel/zitadel Go | All versions | None |
github.com/zitadel/zitadel Go | All versions | 4.15.3 |
github.com/zitadel/zitadel Go | All versions | 4.15.3 |
How do I fix CVE-2026-56668?
Upgrade github.com/zitadel/zitadel to 4.15.3 or later.
Is CVE-2026-56668 being exploited?
There is no known exploitation of CVE-2026-56668 in the wild and no public exploit code.
Sources
Also known as GHSA-vrh8-c9cm-wh8v, GO-2026-6474.