Technical impact
ZITADEL’s external JWT identity provider validation mistakenly skips checking the token’s iat claim when it is omitted, thereby allowing an attacker to replay an arbitrarily old token issued by a trusted authority. This flaw permits the reuse of stale credentials and can result in unauthorized access to protected resources, effectively bypassing authentication and compromising the confidentiality and integrity of the system. The weakness is classified under CWE‑613, Failure to Verify Authorization.
Affected Systems
The affected vendor product is ZITADEL. All releases of the 3.x line prior to version 3.4.12 and all releases of the 4.x line prior to version 4.15.2 are susceptible. No additional sub‑versions are listed, so any instance running a pre‑3.4.12 or pre‑4.15.2 build should be considered vulnerable.
Risk and Exploitability
The CVSS score of 4.2 indicates a moderate impact. The EPSS score of < 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to obtain or craft a stale JWT from a trusted issuer that lacks the iat claim; once in hand, the attacker can present it to ZITADEL over the network, leading to authentication without privileged local access. Based on the description, it is inferred that the attack vector is remote and does not require prior system compromise. While the risk is moderate, operators of older versions should prioritize remediation.
Github GHSA