Go/github.com/zitadel/zitadel CVE-2026-56664: unknown, EPSS 0.32%

ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider in github.com/zitadel/zitadel

Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260615122908-fad02c6d9f45 or later.

go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260615122908-fad02c6d9f45

Affected

Fixed versions

Sources

• osv: GO-2026-5732
• https://github.com/zitadel/zitadel/security/advisories/GHSA-wxg7-w2v3-w38g
• https://github.com/zitadel/zitadel/commit/fad02c6d9f4587956f830d4536c64a9a94baa7ac
• https://github.com/zitadel/zitadel/releases/tag/v3.4.12
• https://github.com/zitadel/zitadel/releases/tag/v4.15.2

CVE-2026-56664 · published 2026-06-25T22:34:38Z · modified 2026-07-11T04:11:11.667802884Z · JSON