{"vulnerability": "cve-2026-56668", "sightings": [{"uuid": "52a3d252-95fa-48f5-aa08-397ab9ed7841", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56668", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfm6nrb62e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56668 \u0432 ZITADEL: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/C9739B81-1592-4C91-95B7-000FE181E9EE", "creation_timestamp": "2026-07-11T00:25:21.952247Z"}, {"uuid": "3748ce91-d33b-4422-968d-70b6369fda30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56668", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfalk4a2i2w", "content": "\ud83d\udfe0 CVE-2026-56668 - High (8.1)\n\nZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token E...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56668/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-11T18:00:48.477087Z"}, {"uuid": "0e1f4f16-c3b0-4f7d-a8be-1f54563fb791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56668", "type": "seen", "source": "https://gist.github.com/alon710/5201f77ce91c5d1ec9edcecc53a2d050", "content": "# CVE-2026-56668: CVE-2026-56668: Privilege Escalation and Cross-Client Audience Bypass in ZITADEL OAuth2 Token Exchange\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56668\n\n## Summary\nA security vulnerability in ZITADEL's backend implementation of the OAuth2 Token Exchange endpoint allows authenticated clients to perform scope escalation and cross-client audience bypass. Prior to version 4.15.3, the Token Exchange flow lacked crucial validation logic, enabling low-privilege tokens to be exchanged for high-privilege tokens or tokens valid within other client applications, violating the OAuth2 delegation model.\n\n## TL;DR\nZITADEL prior to v4.15.3 fails to validate that a subject token belongs to the requesting client or client project, and fails to ensure requested scopes are a subset of the original token scopes. This allows attackers to escalate privileges or bypass cross-client audience boundaries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 8.1\n- **EPSS Score**: 0.00413 (Percentile: 34.75%)\n- **Impact**: Privilege Escalation & Audience Bypass\n- **Exploit Status**: Proof of Concept available in tests\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- ZITADEL OIDC backend package (OAuth2 Token Exchange Flow)\n- **ZITADEL**: < 4.15.3 (Fixed in: `4.15.3`)\n\n## Mitigation\n\n- Upgrade ZITADEL deployments to version 4.15.3 or higher immediately.\n- Review historical logs for suspicious token exchange requests involving mismatched client IDs and escalated scopes.\n\n**Remediation Steps:**\n1. Identify all running instances of ZITADEL in the environment.\n2. Update the container images or binaries to version 4.15.3.\n3. Verify the deployment by executing a test token exchange with an invalid scope to ensure it is rejected with an invalid_scope error.\n4. Monitor authorization server logs for the specific error codes OIDC-zi9Y0 and invalid_scope.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrh8-c9cm-wh8v](https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v)\n- [CVE-2026-56668 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-56668)\n- [CVE-2026-56668 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56668)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56668) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-14T23:32:13.092801Z"}, {"uuid": "9a569b0f-3b63-4779-956e-09f21173a7ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56668", "type": "seen", "source": "https://gist.github.com/alon710/5201f77ce91c5d1ec9edcecc53a2d050", "content": "# CVE-2026-56668: CVE-2026-56668: Privilege Escalation and Cross-Client Audience Bypass in ZITADEL OAuth2 Token Exchange\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56668\n\n## Summary\nA security vulnerability in ZITADEL's backend implementation of the OAuth2 Token Exchange endpoint allows authenticated clients to perform scope escalation and cross-client audience bypass. Prior to version 4.15.3, the Token Exchange flow lacked crucial validation logic, enabling low-privilege tokens to be exchanged for high-privilege tokens or tokens valid within other client applications, violating the OAuth2 delegation model.\n\n## TL;DR\nZITADEL prior to v4.15.3 fails to validate that a subject token belongs to the requesting client or client project, and fails to ensure requested scopes are a subset of the original token scopes. This allows attackers to escalate privileges or bypass cross-client audience boundaries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 8.1\n- **EPSS Score**: 0.00413 (Percentile: 34.75%)\n- **Impact**: Privilege Escalation & Audience Bypass\n- **Exploit Status**: Proof of Concept available in tests\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- ZITADEL OIDC backend package (OAuth2 Token Exchange Flow)\n- **ZITADEL**: < 4.15.3 (Fixed in: `4.15.3`)\n\n## Mitigation\n\n- Upgrade ZITADEL deployments to version 4.15.3 or higher immediately.\n- Review historical logs for suspicious token exchange requests involving mismatched client IDs and escalated scopes.\n\n**Remediation Steps:**\n1. Identify all running instances of ZITADEL in the environment.\n2. Update the container images or binaries to version 4.15.3.\n3. Verify the deployment by executing a test token exchange with an invalid scope to ensure it is rejected with an invalid_scope error.\n4. Monitor authorization server logs for the specific error codes OIDC-zi9Y0 and invalid_scope.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrh8-c9cm-wh8v](https://github.com/zitadel/zitadel/security/advisories/GHSA-vrh8-c9cm-wh8v)\n- [CVE-2026-56668 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-56668)\n- [CVE-2026-56668 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56668)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56668) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-15T00:00:09.351909Z"}]}