ZITADEL is an open source identity management platform. Prior to versions 3.4.12 and 4.15.2, its OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. Based on the description, it is inferred that this flaw violates RFC 6749 Section 4.1.3 and enables an attacker to redeem an intercepted token for a different client’s credentials, effectively granting access to protected resources. This issue is fixed in versions 3.4.12 and 4.15.2.

The vulnerability affects the open source Zitadel identity platform from the vendor Zitadel. Any instance running a version older than 3.4.12 for the 3.x branch or older than 4.15.2 for the 4.x branch is susceptible. Upstream releases 3.4.12 and 4.15.2 contain the correct client_id binding check.

The CVSS score of 7.4 indicates a high severity. The EPSS score is < 1%, suggesting a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to intercept the authorization code or refresh token in transit or have a compromised client to exploit the flaw; once the token is obtained, redemption under a new client is straightforward. The vulnerability violates RFC 6749 Section 4.1.3, underscoring that the misbinding could be leveraged by any entity capable of traffic interception or social engineering. Given the EPSS score and lack of active exploitation data, the likelihood is low to moderate but not negligible.