Skip to content
Threat Feed
Subscribe

Product

ZITADEL (4.0.0 Through 4.15.2)

1 brief RSS
high advisory

ZITADEL Privilege Escalation via OAuth2 Token Exchange

A vulnerability in ZITADEL's OAuth2 Token Exchange endpoint (CVE-2026-56668) allows authenticated users to exchange low-privilege tokens for highly privileged tokens by bypassing authorization and scope validation checks.

ZITADEL +1 auth-bypass privilege-escalation oauth2
1t 1c