Go/github.com/zitadel/zitadel CVE-2026-56664: medium 4.2, EPSS 0.32%

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260615122908-fad02c6d9f45 or later.

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260615122908-fad02c6d9f45

Affected

Fixed versions

Sources

• osv: GHSA-wxg7-w2v3-w38g
• https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g
• https://nvd.nist.gov/vuln/detail/CVE-2026-56664
• https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8
• https://github.com/zitadel/zitadel/commit/d1c3aa84af8fcb0f33910ada30b866f4afb551ac
• https://github.com/zitadel/zitadel/commit/fad02c6d9f4587956f830d4536c64a9a94baa7ac
• https://github.com/zitadel/zitadel
• https://github.com/zitadel/zitadel/releases/tag/v3.4.12
• https://github.com/zitadel/zitadel/releases/tag/v4.15.2

CVE-2026-56664 · published 2026-06-18T13:52:21Z · modified 2026-07-18T17:30:29.136371436Z · JSON