Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-xqxv-4jc2-x56x, stems from a failure to enforce client identity binding in several key OAuth2/OIDC grant flows within ZITADEL, a direct violation of RFC 6749. The analysis of the provided patch commit 0973b074b48816757c47fe732b06d2488d3d284c reveals that the application was missing critical validation to ensure the client exchanging a grant (authorization code, refresh token, or device code) was the same client that originally requested it.
The root cause was the absence of a client_id check in the functions responsible for processing these grants. An attacker who managed to steal a valid grant through external means (e.g., XSS, log leakage) could then use that grant with a different, potentially malicious, client registered on the same ZITADEL instance to gain unauthorized access to the victim's resources.
The patch rectifies this by introducing explicit client_id validation in the affected code paths:
(*Server).codeExchangeV1 function now verifies that the client_id of the requester matches the one stored in the authorization request.(*Commands).ExchangeOIDCSessionRefreshAndAccessToken function was modified to accept the requesting client's ID and delegate the check to refreshTokenComplianceChecker, which now compares it against the ID stored in the OIDC session.(*Commands).CreateOIDCSessionFromDeviceAuth function now validates that the client polling for the token is the same one that initiated the device authorization process.By adding these checks, the patch ensures that grants are bound to the client they were issued to, effectively mitigating the reported vulnerability.
(*Server).codeExchangeV1internal/api/oidc/token_code.go
(*Commands).ExchangeOIDCSessionRefreshAndAccessTokeninternal/command/oidc_session.go
(*Commands).CreateOIDCSessionFromDeviceAuthinternal/command/device_auth.go
refreshTokenComplianceCheckerinternal/api/oidc/token_refresh.go
(*Server).RefreshTokeninternal/api/oidc/token_refresh.go
(*Server).DeviceTokeninternal/api/oidc/token_device.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zitadel/zitadel | go | < 1.80.0-v2.20.0.20260616131956-0973b074b488 | 1.80.0-v2.20.0.20260616131956-0973b074b488 |
code_verifier. However, PKCE does not protect against refresh token cross-use.Systems running one of the following versions are affected:
4.0.0 through 4.15.1 (including RC versions)3.0.0 through 3.4.11 (including RC versions)The vulnerability has been addressed in the latest releases by re-introducing strict client identity validation on the CodeExchange and RefreshToken grants.
Please upgrade to one of the following secure versions:
The recommended solution is to upgrade to a patched version.
To reduce exposure in the interim, ensure absolute adherence to application security best practices to prevent credential/token theft, enforce the use of PKCE for all clients to mitigate the Authorization Code Injection risk, and minimize refresh token lifespans.
If you have any questions or comments about this advisory, please email us at security@zitadel.com
Thanks to kodareef5, Shubham Raj / Causal Security, and Gaurav Popalghat for identifying and responsibly reporting this or a part of this vulnerability.