vulnerability

CVE-2026-56668

NVD HIGH 8.1 · published 2026-07-10 · 1 on the wire

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.

Exploited in the wild

Not on KEV

Not in CISA's Known Exploited Vulnerabilities catalogue as of the last daily pull. Absence is not proof of safety.

EPSS · 30-day forecast

Chance of exploitation in the next 30 days, 35th percentile of all CVEs. A forecast; KEV outranks it.

CVSS · NVD

8.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Internet exposure

—

No exposure census on this CVE's dispatches.

On the wire1

15 SepGHSA-vrh8-c9cm-wh8v: ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token ExchangeVULN

References

Early access

Watch this one?

Early access opens alerts first — one email when a CVE you follow lands on KEV or an adversary you follow lands on the wire. Nothing else, ever.

bot-protected