{"action":"Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later.","affected":[{"fixed":"1.80.0-v2.20.0.20260616131956-0973b074b488","introduced":"0"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2026-55672"],"ecosystem":"Go","epss":0.00433,"exploited":false,"fixed_versions":["1.80.0-v2.20.0.20260616131956-0973b074b488"],"ghsa_id":"GHSA-xqxv-4jc2-x56x","id":"tcs_01M5KFSMGVHKBPD95JBEFKGPWD","modified_at":"2026-07-15T22:00:52.768267515Z","published_at":"2026-06-18T13:52:18Z","references":["https://osv.dev/vulnerability/GHSA-xqxv-4jc2-x56x","https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x","https://nvd.nist.gov/vuln/detail/CVE-2026-55672","https://github.com/zitadel/zitadel/commit/0973b074b48816757c47fe732b06d2488d3d284c","https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71","https://github.com/zitadel/zitadel/commit/5b1708e0e650398f0ebc3341714f0798b0118917","https://github.com/zitadel/zitadel","https://github.com/zitadel/zitadel/releases/tag/v3.4.12","https://github.com/zitadel/zitadel/releases/tag/v4.15.2"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-xqxv-4jc2-x56x","url":"https://osv.dev/vulnerability/GHSA-xqxv-4jc2-x56x"}],"summary":"ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)"}