Go/github.com/zitadel/zitadel CVE-2026-55672: high 7.4

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later.

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260616131956-0973b074b488

Affected

Fixed versions

Sources

• osv: GHSA-xqxv-4jc2-x56x
• https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x
• https://nvd.nist.gov/vuln/detail/CVE-2026-55672
• https://github.com/zitadel/zitadel/commit/0973b074b48816757c47fe732b06d2488d3d284c
• https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71
• https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917
• https://github.com/zitadel/zitadel
• https://github.com/zitadel/zitadel/releases/tag/v3.4.12
• https://github.com/zitadel/zitadel/releases/tag/v4.15.2

CVE-2026-55672 · published 2026-06-18T13:52:18Z · modified 2026-07-15T22:00:52.768267515Z · JSON