ZITADEL’s OAuth2 Token Exchange endpoint for the grant type urn:ietf:params:oauth:grant-type:token-exchange has an insufficient authorization check that does not confirm that the subject token belongs to the requesting client or that the requested scopes are no broader than the original token’s scopes. This flaw allows an attacker carrying a low‑privilege token to exchange it for a token with higher permissions at a different application, resulting in elevation of privileges. The weakness is classified as insufficient authorization (CWE‑862).

All ZITADEL releases before version 4.15.3 are affected. Deployments using earlier binaries, containers, or custom builds should verify the installed version and upgrade to the 4.15.3 release or later.

The CVSS score of 8.1 places the vulnerability in the high‑severity range. Exploitation requires a valid low‑privilege token and an HTTP request to the token‑exchange endpoint. In practice, the attacker must already possess a token that is valid for the issuer. The EPSS score of less than 1% indicates a very low yet non‑zero probability that the vulnerability will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an HTTP request to the OAuth2 token‑exchange endpoint where the client supplies a token it does not own or requests scopes beyond those originally granted.