ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, its external JWT Identity Provider validates a token's signature and issuer (iss) but not the audience (aud) claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted by ZITADEL. This issue is fixed in versions 3.4.12 and 4.15.2. The weakness is an access control problem (CWE‑346).

All ZITADEL instances running versions prior to 3.4.12 in the 3.x line or prior to 4.15.2 in the 4.x line rely on the external JWT IdP integration without checking the aud claim.

The vulnerability carries a CVSS score of 4.2, indicating medium risk, and an EPSS score of < 1%. It is not listed in CISA's KEV catalog. The likely attack vector is a scenario where an attacker obtains or crafts a JWT from a trusted issuer for a different relying party and presents it to ZITADEL. Because the token is already signed, the attacker requires knowledge of the issuer’s signing key or a token issued by that key. Without the audience check, ZITADEL will accept the token, granting the attacker whatever permissions the token encodes.