{"action":"Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260616131956-0973b074b488 or later.","affected":[{"fixed":"1.80.0-v2.20.0.20260616131956-0973b074b488","introduced":"0"}],"component":"github.com/zitadel/zitadel","cve_ids":["CVE-2026-55672"],"ecosystem":"Go","epss":0.00433,"exploited":false,"fixed_versions":["1.80.0-v2.20.0.20260616131956-0973b074b488"],"ghsa_id":"GHSA-xqxv-4jc2-x56x","id":"tcs_01M5KGPSFHP45DW3FE0BSYDE36","modified_at":"2026-06-25T23:01:44.027610179Z","published_at":"2026-06-25T22:34:41Z","references":["https://osv.dev/vulnerability/GO-2026-5768","https://github.com/zitadel/zitadel/security/advisories/GHSA-xqxv-4jc2-x56x","https://github.com/zitadel/zitadel/commit/0973b074b48816757c47fe732b06d2488d3d284c","https://github.com/zitadel/zitadel/releases/tag/v3.4.12","https://github.com/zitadel/zitadel/releases/tag/v4.15.2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5768","url":"https://osv.dev/vulnerability/GO-2026-5768"}],"summary":"ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) in github.com/zitadel/zitadel"}