CVE-2026-55669: Zitadel

Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days.

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer (iss) but not the audience (aud) claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted by ZITADEL. This issue is fixed in versions 3.4.12 and 4.15.2.

Affected products

• Zitadel Zitadel: from 4.0.0-rc.1, before 4.15.2 (fixed in 4.15.2); before 3.4.12 (fixed in 3.4.12)

Published 2026-07-10. Last modified 2026-07-10.