ZITADEL is an open source identity management platform. Prior to versions 3.4.12 and 4.15.2, its OAuth2 and OIDC code exchange, refresh token, and device token flows do not verify that the client making the grant request is the same client that initiated the authorization flow, allowing an attacker who obtains an intercepted authorization code or refresh token to redeem it under a different client. This misbinding enables the attacker to gain unauthorized access to protected resources. The flaw is fixed in the released versions 3.4.12 and 4.15.2.

The vulnerability affects the open source Zitadel identity platform from the vendor Zitadel. Any instance running a version older than 3.4.12 for the 3.x branch or older than 4.15.2 for the 4.x branch is susceptible. Upstream releases 3.4.12 and 4.15.2 contain the correct client_id binding check.

The CVSS score of 7.4 indicates a high severity, while the EPSS score of < 1% suggests a low but non‑zero likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. An attacker would need to capture an authorization code or refresh token in transit or compromise a client to exploit the flaw; once the token is in hand, it can be exchanged under a client that did not initiate the flow, granting access to protected resources. The primary vulnerability is a missing client_id association during token exchange, a classic example of CWE‑287 (Improper Authentication) and CWE‑863 (Missing Authorization in an Authenticating Service).