CVE-2026-55672
2 advisories.
Go/github.com/zitadel/zitadel CVE-2026-55672: high 7.4, EPSS 0.43%
ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later.
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260616131956-0973b074b488Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.80.0-v2.20.0.20260616131956-0973b074b488 | - |
Fixed versions
| 1.80.0-v2.20.0.20260616131956-0973b074b488 |
Sources
- osv: GHSA-xqxv-4jc2-x56x
- https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x
- https://nvd.nist.gov/vuln/detail/CVE-2026-55672
- https://github.com/zitadel/zitadel/commit/0973b074b48816757c47fe732b06d2488d3d284c
- https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71
- https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917
- https://github.com/zitadel/zitadel
- https://github.com/zitadel/zitadel/releases/tag/v3.4.12
- https://github.com/zitadel/zitadel/releases/tag/v4.15.2
CVE-2026-55672 · published · modified · JSON
Go/github.com/zitadel/zitadel CVE-2026-55672: unknown, EPSS 0.43%
ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) in github.com/zitadel/zitadel
Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later.
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260616131956-0973b074b488Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.80.0-v2.20.0.20260616131956-0973b074b488 | - |
Fixed versions
| 1.80.0-v2.20.0.20260616131956-0973b074b488 |
Sources
- osv: GO-2026-5768
- https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x
- https://github.com/zitadel/zitadel/commit/0973b074b48816757c47fe732b06d2488d3d284c
- https://github.com/zitadel/zitadel/releases/tag/v3.4.12
- https://github.com/zitadel/zitadel/releases/tag/v4.15.2
CVE-2026-55672 · published · modified · JSON