ZITADEL is an open‑source identity management platform. Prior to 3.4.12 and 4.15.2, the external JWT Identity Provider validates a token's signature and issuer (iss), but does not check the audience (aud) claim. This oversight allows a validly signed token issued by a trusted authority for a different relying party to be accepted by ZITADEL. The vulnerability, an access control flaw categorized as CWE‑346, grants an attacker the ability to impersonate or elevate privileges by replaying a token meant for another service.

All ZITADEL instances running versions prior to 3.4.12 in the 3.x line or prior to 4.15.2 in the 4.x line rely on the external JWT IdP integration without checking the aud claim.

The vulnerability carries a CVSS score of 4.2, indicating medium risk, and an EPSS score of < 1 %. It is not listed in CISA's KEV catalog. The likely attack vector is a scenario where an attacker obtains or crafts a JWT from a trusted issuer for a different relying party and presents it to ZITADEL. Because the token is already signed, the attacker only needs a validly signed token from the trusted issuer. Without the audience check, ZITADEL will accept the token, granting the attacker whatever permissions the token encodes.