Zitadel OIDC Authorization Code and Refresh Token Binding Bypass (CVE-2026-55672)

Vulnerability Overview Title: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) Description: Zitadel's OAuth2/OIDC Code Exchange and Refresh Token implementations lack a critical validation step to ensure that the requesting client matches the client that originally initiated the authorization code. This violates Section 4.1.3 of RFC 6749, which mandates that the authorization server must ensure the authorization code was issued to an authenticated confidential client. Impact Scope Impact: This vulnerability creates potential exploitability in two main authentication phases, contingent upon specific external preconditions: Authorization Code Injection: An attacker can intercept an authorization code (via separate application vulnerabilities such as XSS, token leakage, logging issues, or network interception) and use credentials from a completely different client (ClientB) to exchange for tokens, without validating client binding. Refresh Token Cross-Use: After successfully stealing a valid refresh token (via external application vulnerabilities or data breaches), an attacker can use it in a different client context. While Zitadel validates the token format and expiration time, it fails to enforce client binding, allowing an attacker to gain persistent access from an unauthorized client. Device Authorization Cross-Use: An attacker can access or manipulate device authorization flow grants to complete exchanges using different client contexts, thereby bypassing expected client boundaries. Scope and Mitigating Factors: External Preconditions: Exploiting any vector requires a pre-existing vulnerability or data leak to intercept codes or tokens within the target application environment. Multi-tenant Risk: In shared or multi-tenant instances, tokens issued to one client could theoretically be exploited by another tenant. PKCE Protection: If clients strictly use PKCE (Proof Key for Code Exchange) for the authorization code flow, this partially mitigates the authorization code injection vector; however, PKCE does not protect against refresh token cross-use. Remediation Affected Versions: 4.x: 4.0.0 through 4.15.1 (including Release Candidate versions) 3.x: 3.0.0 through 3.4.11 (including Release Candidate versions) Patch: The vulnerability has been resolved in the latest versions by re-introducing strict client authentication. Please upgrade to one of the following secure versions: 4.x: Upgrade to > 4.15.2 3.x: Upgrade to > 3.4.12 Workaround: The recommended solution is to upgrade to the patched version. To reduce exposure, strictly adhere to application security best practices to prevent credential/token theft, enforce PKCE usage for all clients to mitigate authorization code injection risks, and minimize the lifespan of refresh tokens. Additional Information CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None CVE ID: CVE-2026-55672 Weaknesses: CWE-287 CWE-863 Credits: Reporter: kodareel5 Remediation developer: grvjayan Remediation reviewer: IAM-marco Others: livio-a Reporter: cipher-creator Reporter: N00bx Acknowledgments: Thanks to kodareel5, Shubham Rai (Causal Security), and Gaurav Popalghat for their contributions in identifying and responsibly reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Zitadel OIDC Authorization Code and Refresh Token Binding Bypass (CVE-2026-55672)

More from this source