CVE-2026-55672

highCVSS 7.4covered by 1 sourcefirst seen 2026-07-10

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.

⚡ Watch CVE-2026-55672

Get an email if CVE-2026-55672 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-55672: ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's …nvd · 2026-07-10

External references

NVD record for CVE-2026-55672

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55672 status](https://www.csirts.com/badge/CVE-2026-55672)](https://www.csirts.com/cve/CVE-2026-55672)