CVE-2026-56668 in ZITADEL
Zusammenfassung
von MITRE • 10.07.2026
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.